diff --git a/SECURITY.md b/SECURITY.md
index 3053662..6b9011b 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -11,9 +11,11 @@ releases. Older releases receive critical-severity fixes only.
 
 ## Reporting a vulnerability
 
+The preferred channel is GitHub private vulnerability reporting: open a private report at <https://github.com/simtabi/release-kit/security/advisories/new>. The report stays attached to the repository, with a draft advisory and a CVE request path. Email **security@simtabi.com** if you do not use GitHub.
+
 **Do not open a public GitHub issue for security problems.**
 
-Disclosure goes to `opensource@simtabi.com`. Include:
+Disclosure goes to `security@simtabi.com`. Include:
 
 - A description of the vulnerability and its impact.
 - Steps to reproduce (minimum proof-of-concept).