GitHub added a new Security Tab that has tools for discussing security issues and publishing a disclosure policy (See: https://github.com/amberframework/amber/security/policy). It provides a template and the tools necessary to setup one to satisfy GitHub's tooling. The maintainers should discuss and create a policy.