We should set up a security policy in GitHub to enable the relevant teams are informed of security reports.