docs(security): prefer GitHub private vulnerability reporting

Surface GitHub's native private reporting workflow as the primary
disclosure channel, with security@astrolabecloud.com kept as a fallback
for reporters without a GitHub account. Updates SECURITY.md, the README
Security section, the issue-template config link, and the bug-template
warning banner.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -11,7 +11,7 @@ body:
         **Before submitting**, please check that:
         - You're running a recent version (`uvx nextcloud-mcp-server --version` or check the Docker tag).
         - The issue isn't already reported in [open issues](https://github.com/cbcoutinho/nextcloud-mcp-server/issues).
-        - Security issues should **not** be filed here — see [SECURITY.md](https://github.com/cbcoutinho/nextcloud-mcp-server/blob/master/SECURITY.md).
+        - Security issues should **not** be filed here — use [private vulnerability reporting](https://github.com/cbcoutinho/nextcloud-mcp-server/security/advisories/new) or see [SECURITY.md](https://github.com/cbcoutinho/nextcloud-mcp-server/blob/master/SECURITY.md).
 
   - type: textarea
     id: summary

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,8 @@
 blank_issues_enabled: false
 contact_links:
-  - name: Security vulnerability
-    url: https://github.com/cbcoutinho/nextcloud-mcp-server/blob/master/SECURITY.md
-    about: Do not file security issues publicly. Email security@astrolabecloud.com — see SECURITY.md.
+  - name: Security vulnerability (private report)
+    url: https://github.com/cbcoutinho/nextcloud-mcp-server/security/advisories/new
+    about: Do not file security issues publicly. Use GitHub's private vulnerability reporting, or see SECURITY.md for the email fallback.
   - name: Question or discussion
     url: https://github.com/cbcoutinho/nextcloud-mcp-server/discussions
     about: For general questions, deployment help, or open-ended discussion, please use Discussions instead of opening an issue.

README.md

@@ -248,7 +248,7 @@ This project takes security seriously:
 - No credential storage in OAuth mode
 - Regular security assessments
 
-Found a security issue? **Do not open a public GitHub issue.** Please report it privately by emailing **security@astrolabecloud.com**. See [SECURITY.md](./SECURITY.md) for details.
+Found a security issue? **Do not open a public GitHub issue.** Use GitHub's [private vulnerability reporting](https://github.com/cbcoutinho/nextcloud-mcp-server/security/advisories/new), or email **security@astrolabecloud.com** if you can't use GitHub. See [SECURITY.md](./SECURITY.md) for details.
 
 ## License
 

SECURITY.md

@@ -2,17 +2,29 @@
 
 ## Reporting a Vulnerability
 
-**Please do not report security vulnerabilities through public GitHub issues.**
+**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**
 
-If you discover a security vulnerability in this project, report it privately by emailing:
+### Preferred: GitHub Private Vulnerability Reporting
+
+Use GitHub's built-in private reporting workflow:
+
+➡️ **[Report a vulnerability](https://github.com/cbcoutinho/nextcloud-mcp-server/security/advisories/new)**
+
+This opens a private draft security advisory visible only to the repository maintainers. You can also reach the same form from the **Security** tab → **Report a vulnerability**.
+
+### Fallback: Email
+
+If you cannot use GitHub's private reporting (for example, you don't have a GitHub account), email:
 
 **security@astrolabecloud.com**
 
-Please include as much of the following information as possible to help us triage your report:
+### What to include
+
+Whichever channel you use, please include as much of the following as you can to help us triage:
 
 - A description of the vulnerability and its potential impact
-- Steps to reproduce the issue (proof-of-concept code, if applicable)
+- Steps to reproduce (proof-of-concept code, if applicable)
 - The version(s) of the project affected
 - Any known mitigations or workarounds
 
-We will acknowledge receipt of your report and work with you on coordinated disclosure.
+We will acknowledge receipt and work with you on coordinated disclosure.