Commit 9dbff4dd for tesseract

commit 9dbff4dd7afe596690342bdaeac3d75d8d354519
Author: Stefan Weil <sw@weilnetz.de>
Date:   Wed Nov 11 21:54:27 2026 +0100

    SECURITY: steer vulnerability reports to GitHub's private reporting

    Prefer GitHub's private vulnerability reporting over direct e-mail,
    since it keeps the report private until a fix is available, carries
    the reporter's credit, and feeds CVE assignment. E-mail stays
    available for reporters without a GitHub account.

    Ask reporters to state their full name or the handle they want
    credited (or to opt out), so fixes can carry a reliable
    Reported-by trailer, and to disclose whether and how AI was involved
    in finding or writing up the report, so maintainers can gauge how
    much verification to invest.

    Add a pacing section: each report needs a reproduction, a fix and a
    test, and maintainer resources are limited, so report one at a time
    and wait for the existing reports to be handled before sending new
    ones; group related findings or coordinate large fuzzing campaigns
    with a maintainer. Mention GitHub's own rate limits for private
    reports, which back this up.

    Assisted-by: OpenCode / Qwen3.8-27B-Thinking (Alibaba Cloud)
    Signed-off-by: Stefan Weil <sw@weilnetz.de>

diff --git a/SECURITY.md b/SECURITY.md
index 6817ef61..a1a108b9 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -2,9 +2,6 @@

 ## Supported Versions

-Use this section to tell people about which versions of your project are
-currently being supported with security updates.
-
 | Version | Supported          |
 | ------- | ------------------ |
 | 5.5.x   | :white_check_mark: |
@@ -12,6 +9,36 @@ currently being supported with security updates.

 ## Reporting a Vulnerability

-Please contact one of the current maintainers if you want to report a vulnerability.
-See the [latest releases](https://github.com/tesseract-ocr/tesseract/releases)
+Please prefer GitHub's private vulnerability reporting, which keeps the
+report private until a fix is available, credits you in the published
+advisory, and can receive a CVE. Open the repository's "Security and
+quality" tab and click "Report a vulnerability".
+
+If you do not have a GitHub account, you may instead e-mail one of the
+current maintainers. See the
+[latest releases](https://github.com/tesseract-ocr/tesseract/releases)
 and the Git history for their names and e-mail addresses.
+
+In your report, please include your full name or the handle you would
+like to receive as credit in the fix commit and the advisory. Omit it
+if you prefer to remain anonymous; we will acknowledge the report
+privately in that case. Also tell us whether and how AI was involved in
+finding or writing up the report (for example: found by a fuzzer,
+analyzed or verified with an AI tool, or report text AI-generated), so
+we know how much verification we should put into the report before
+acting on it.
+
+## Pacing reports
+
+We handle security reports as they arrive, with limited maintainer
+resources, and each report needs a reproduction, a fix, and a test
+before it can be closed. To make sure every report gets the attention
+it needs, please process your reports one at a time: wait for a
+response or a fix for your existing reports before submitting new
+ones. If you have found several issues, it is usually better to group
+them into a single report than to send a series of separate reports;
+if you have a large number of findings (for example from a fuzzing
+campaign), contact a maintainer in a first report and coordinate how
+to proceed. Note that GitHub also enforces its own rate limits on
+private vulnerability reports, so bursts of reports may simply be
+rejected.