The option `Private vulnerability reporting` is not available for private repositories. Enable it once the repository is public.