The preferred way is using the GitHub "Security and quality" Tab in the affected Repository.

Or you can report them via E-Mail:

• To Zoey and David: zoeyvid@zvcdn.de, you can find the public key for encrypted communication here: https://github.com/ZoeyVid/.github/blob/main/publickey.asc / https://zvcdn.de/publickey.asc
• Only to Zoey: zoey@z0ey.de, you can find the public key for encrypted communication here: https://github.com/Zoey2936.gpg