From the OpenSSF Best Practice requirements:

1. The project MUST publish the process for reporting vulnerabilities on the project site. (URL required)
2. If private vulnerability reports are supported, the project MUST include how to send the information in a way that is kept private.

Example: https://github.com/helm/community/blob/main/SECURITY.md