Where to report security issues?

Hi maintainers, could you enable GitHub’s Private vulnerability reporting for this repo so researchers can report security issues privately?
Adding a SECURITY.md with preferred contact/SLAs would also help. Thanks!