Preferred channel to report a security issue privately?

[Humbertosp]

Hi 👋 — we'd like to report a security finding privately, but the repo has no SECURITY.md and GitHub private vulnerability reporting doesn't appear to be enabled (/security/advisories/new returns 404).

Could you point us to a private channel (e.g. a security email), or consider enabling private vulnerability reporting on the repo? We'll share the details as soon as there's a private route — nothing sensitive here in public.

Thanks! — SVO (svo.com.br)

[adeebshihadeh]

See https://github.com/commaai/openpilot/blob/master/SECURITY.md