diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index d85f47ee5..07fd1d1cf 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -1,5 +1,8 @@
 blank_issues_enabled: false
 contact_links:
+  - name: Report a security vulnerability (private)
+    url: https://github.com/lidge-jun/opencodex/security/advisories/new
+    about: Report undisclosed vulnerabilities privately to the maintainers. Do not open a public issue.
   - name: Security policy
     url: https://github.com/lidge-jun/opencodex/blob/main/SECURITY.md
     about: Read the supported-version and reporting guidance before sharing security-sensitive details.
diff --git a/README.md b/README.md
index cd8d98074..86b30f082 100644
--- a/README.md
+++ b/README.md
@@ -509,6 +509,9 @@ The public docs — install, providers, routing, sidecars, Codex integration, Co
 Maintainer source-of-truth notes live under [`structure/`](./structure). Historical investigations remain under [`docs/`](./docs).
 Contributor setup lives in [`CONTRIBUTING.md`](./CONTRIBUTING.md), and security reporting guidance
 lives in [`SECURITY.md`](./SECURITY.md).
+Report undisclosed vulnerabilities privately through
+[GitHub private vulnerability reporting](https://github.com/lidge-jun/opencodex/security/advisories/new),
+not a public issue.
 
 ## Development
 
diff --git a/SECURITY.md b/SECURITY.md
index a9802c920..b39af65d2 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -17,13 +17,19 @@ or the latest published package before triage continues.
 
 Please avoid posting undisclosed vulnerabilities as public GitHub issues.
 
-- Prefer this repository's GitHub private vulnerability reporting or GitHub Security Advisory flow
-  when that option is available in the repository UI.
-- If no private reporting option is available, do not include exploit details, secrets, or live
-  targets in a public issue. Open a minimal issue that asks maintainers for a safe coordination path.
-- Include affected versions, reproduction steps, impact, and any required configuration details.
+Report privately through GitHub private vulnerability reporting, which is enabled on this
+repository:
 
-The project does not publish a dedicated private security email in this repository.
+**<https://github.com/lidge-jun/opencodex/security/advisories/new>**
+
+The same form is reachable from the repository's **Security** tab under **Report a vulnerability**.
+It is private between you and the maintainers, and it is the only channel this project offers for
+undisclosed vulnerabilities — there is no dedicated private security email.
+
+Include affected versions, reproduction steps, impact, and any required configuration details.
+
+If the form is ever unreachable for you, open a minimal public issue that asks maintainers for a
+safe coordination path. Do not include exploit details, secrets, or live targets in that issue.
 
 ## Response Expectations