docs: report security issues via GitHub draft advisories

[fzipi]

What

Updates the README "Security issue" section and SECURITY.md to direct reporters to GitHub's private vulnerability reporting flow (draft security advisories) instead of the mailbox. The email address stays as a fallback for reporters without a GitHub account.

Why

The project now prefers security submissions through draft advisories: the report stays private, triage and the fix are coordinated in one place, and the advisory is published with the fixed release. The README and SECURITY.md still only mentioned the email address.

Documentation-only change; targets v3/master because GitHub reads SECURITY.md from the default branch.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation
  • Updated security vulnerability reporting guidance to use private GitHub draft advisories, with email as an alternative for those unable to access GitHub.
  • Clarified coordinated triage and fixes, publication with the fixed release, and reporter credit.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 687c3110-2f54-41ea-85e9-d644cd2d3656

📥 Commits

Reviewing files that changed from the base of the PR and between 48e561b and d09384f.

📒 Files selected for processing: 2

• README.md
• SECURITY.md

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Walkthrough

The README and security policy now direct reporters to submit a private GitHub draft security advisory. They describe maintainer coordination, publication with the fix, reporter credit, and an email fallback.

Changes: Security reporting guidance

Layer / File(s)	Summary
Update security reporting instructions SECURITY.md, README.md	Both documents direct reporters to a private GitHub draft security advisory, describe coordination and publication details, and provide an email fallback when GitHub is unavailable.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to d0938

The updated guidance provides a working private reporting route and an email fallback, with no identified issue blocking merge.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main documentation change: directing security reports to GitHub draft advisories.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[airween]

Thank you, @fzipi!