From e810ba893af204ed5255fae12f7799f90bf589b7 Mon Sep 17 00:00:00 2001
From: Sparsh Sam <110058692+sparshsam@users.noreply.github.com>
Date: Sun, 23 Aug 2026 20:11:31 -0400
Subject: [PATCH] security: route vulnerability reports to private
 vulnerability reporting

---
 SECURITY.md | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/SECURITY.md b/SECURITY.md
index 531472a..1190b74 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -2,7 +2,15 @@
 
 OpenReader is designed to process PDFs locally. It does not upload files or call network services.
 
-If you discover a security issue, please open a GitHub issue with a clear description and reproduction steps. Avoid sharing private or sensitive PDF files in public issues.
+If you discover a security issue, please report it privately — do not open a public issue.
+
+Use GitHub's private vulnerability reporting:
+
+1. Open the **Security** tab of this repository.
+2. Click **Report a vulnerability**.
+3. Complete the form with as much detail as you can provide.
+
+Include: a clear description of the issue, reproduction steps, the OpenReader version or commit, and whether any PDF data could be exposed. Avoid sharing private or sensitive PDF files unless necessary.
 
 ## Supported Versions