In the repository's security policy, the email address to report the vulnerabilities to is a placeholder value [INSERT SECURITY EMAIL]
Which is understandable for a fresh project, but should be remediated early on.