Security: preferred channel to report a vulnerability privately?

Hi — I'm a security researcher and I've identified what I believe is a security issue in certvalidator (a denial-of-service condition reachable through normal certificate-path validation). I'd like to disclose it responsibly and privately, with a proof of concept and a suggested fix.

I'm not including any technical detail here to avoid publicly disclosing an unpatched issue.

This repository currently has no SECURITY.md and GitHub Private Vulnerability Reporting appears to be disabled (Security → Advisories → "Report a vulnerability" is not available). Could you either:

1. Enable Private Vulnerability Reporting for this repo (Settings → Code security → "Private vulnerability reporting"), so I can file a private advisory here; or
2. Share a security contact / email I can send the report to?

Happy to provide the full write-up and PoC as soon as there's a private channel. Thanks!

Review the repository's Settings → Code security options and check whether SECURITY.md exists, as requested in the issue. The work is done when a private reporting channel is enabled or a security contact and disclosure instructions are documented for the researcher.