A maintainer of a popular open-source project wants outside researchers to know how to privately report a discovered security vulnerability, rather than opening a public issue that could expose users to attacks. Which repository file should the maintainer add to communicate this reporting process?