diff --git a/README.md b/README.md
index 7bb6a0aa9..3cff2ec10 100644
--- a/README.md
+++ b/README.md
@@ -446,9 +446,13 @@ is one.
 
 ### Security issue
 
-Please do not make public any security issue. Contact us at:
-modsecurity@owasp.org reporting the issue. Once the problem is fixed your
-credit will be given.
+Please do not report security issues publicly. Instead, open a
+[draft security advisory](https://github.com/owasp-modsecurity/ModSecurity/security/advisories/new)
+on GitHub so the report stays private while the maintainers triage it and
+prepare a fix. The advisory is published together with the fixed release, and
+reporters are credited in it.
+
+If you cannot use GitHub, email modsecurity@owasp.org instead.
 
 ## Feature request
 
diff --git a/SECURITY.md b/SECURITY.md
index fafb57326..17707dfba 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -6,4 +6,13 @@ The latest versions of both v2.9.x and v3.0.x are supported.
 
 ## Reporting a Vulnerability
 
-For information on how to report a security issue, please see https://github.com/owasp-modsecurity/ModSecurity#security-issue
+Please do not report security issues publicly (no GitHub issues, pull
+requests or mailing lists).
+
+Report them privately by opening a
+[draft security advisory](https://github.com/owasp-modsecurity/ModSecurity/security/advisories/new)
+on GitHub. The maintainers triage the report there, coordinate a fix with you
+and publish the advisory together with the fixed release. Reporters are
+credited in the published advisory.
+
+If you cannot use GitHub, email modsecurity@owasp.org instead.