Security contact / private vulnerability reporting?

[nullconstruct]

Hello,
I've found a memory-safety issue in libSPERR's decompression path and would like to report it privately. Could you enable GitHub's private vulnerability reporting (Settings → Security), or share a security contact? Thanks.