Security contact / private vulnerability reporting

[jplopezy]

Hello,

I found a filename-handling security issue in PyMuPDF's embedded-file extraction and would like to coordinate it privately before any public disclosure.

Could you let me know the preferred private channel for the details (a security contact email, or enabling GitHub's Private Vulnerability Reporting for this repo)?

Thanks.