How to contact for security issues & Adding security policy

[arkark]

Summary

I found a security issue in radash, but I could not find the way to contact the project maintainers privately.
May I ask you to tell me a contact method you prefer?

FYI

I suggest you to put SECURITY.md (a security policy) at the root.

As another choice, if the project maintainers enable "Private vulnerability reporting" on GitHub, I can report the issue privately.

• ref: https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository#enabling-or-disabling-private-vulnerability-reporting-for-a-repository