You can report vulnerabilities in the security tab by clicking "Reporting a vulnerability".
Don't report vulnerabilities publicy (creating public issue, starting discussion or creating pull request).