Security issue – request for private disclosure channel

[Fewword]

I recently audited this project and found several security vulnerabilities. I would like to report them privately so they can be fixed before any public disclosure.

I noticed the repository currently lacks:

• A SECURITY.md file
• A vulnerability disclosure policy
• Security-related issue templates or labels

Could you advise:

1. Is there a preferred email or private channel where I can send the detailed vulnerability report?
2. Would you prefer I use the GitHub Security Advisory feature instead?
3. Would you consider adding a SECURITY.md to guide future reporters?

Thank you!