tl;dr: Public security.txt file to be used to instruct people how to handle security flaws.