Vulnerabilities will be reported on the website via form or with some alternative methods.

We wouldn't really want vulnerabilities published directly to Github until the teams can analyze the risk, so the site will have all the info.