Bugs and feature requests are better as issues, where the answer stays readable for whoever hits the same thing.
Security reports go through GitHub's private vulnerability reporting, not to that address and not to a public issue: a report that arrives in one person's inbox waits for that person.