Regarding the spam concern, from securitytxt.org:
> Will adding an email address expose me to spam bots? > > The email value is an optional field. If you are worried about spam, you can set a URI as the value and link to your security policy.
> Will adding an email address expose me to spam bots? > > The email value is an optional field. If you are worried about spam, you can set a URI as the value and link to your security policy.