You can use GitHub's private vulnerability reporting. Simply go to the "Security" tab of this project and click "Report a Vulnerability".

For non-sensitive items, just open an issue.