Preferred private security contact?

Hello,

I have a minimized Rust memory-safety report for wasm-bindgen. GitHub private vulnerability reporting appears to be disabled for this repository, and I do not want to post technical details publicly.

Could a maintainer either enable GitHub private vulnerability reporting for this repository or point me to the preferred private security contact?

I can send the full reproducer, oracle log, and repair notes privately.

Thanks.