Filing security bugs?/Security policy for the project?

[tomato42]

I don't see any security policy or email for filing security bugs. What's the expectation? Could you document it? (or did I just miss it?)

[sfackler]

I think my first preference would be an issue on the repo. If it's something particularly impactful that you want to report privately, feel free to email me at sfackler@gmail.com.

I should write up a security policy in the repo stating that.