Hacker News Reader

I'd be much happier getting security concern inqueries via my git log email than the recruiter spam I've gotten in practice!

Aye, this is what the commit logs are for, and why it's important to be reachable at your git config user.email. Git user's email addresses are not private.

Yes, if it is a small project by all means do that

For bigger projects there's usually a security@ email address or similar

I do that too, though I usually also give the code author a heads up first, so they are not surprised when their SOC reach out to them. Sometimes security orgs can be a little abrasive or terse which can be unnerving.

Yes