diff --git a/SECURITY.md b/SECURITY.md
index 88218d35d..fa3241080 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -7,6 +7,5 @@ and released just like all other bugs.
 
 ## Reporting a vulnerability
 
-Preferably send an email to kovid at kovidgoyal.net or open an issue in the
-GitHub repository, though the latter means you are disclosing the vulnerability
-publicly before it can be fixed.
+Preferably send an email to kovid at kovidgoyal.net or open a private security
+advisory using the GitHub security advisory facility.