Currently, the README.md reads as follow

If you are reporting a security issue, please follow the responsible disclosure guidelines and reach out discreetly at [email protected].

Those responsible disclosure guidelines need to be define somewhere (either in this repo, or we can link to one we agree upon).