Having a security.txt would be best, but they've updated the page to include a security email address which is a start.