Preferred private channel for security report?

Hi, I tried to send a security report to [email protected], but delivery failed because the recipient server did not accept the connection.

I have a locally reproduced security report affecting @browsermcp/mcp and would like to disclose it privately. Is there a preferred private security contact, GitHub Security Advisory workflow, or email address I should use?

I can share the full report and local-only PoC once a private channel is confirmed.