doc(security): amend outdated security policy info

Author: eternal-flame-AD

SECURITY.md

@@ -2,11 +2,21 @@
 
 ## Supported Versions
 
-Only the latest version.
+Only the latest released version. 
+
+If you found a vulnerability that only applies to older versions but has been accidentally fixed recently, please also open a private advisory to let us evaluate if a backdated advisory should be necessary.
+
+If you found a vulnerability in unreleased code (Git trunk), please verify that the latest release is not affected and then use the public issue and pull request workflow to submit your research.
 
 ## Reporting a Vulnerability
 
-Please report (suspected) security vulnerabilities to
-**[gotify@protonmail.com](mailto:gotify@protonmail.com)**. You will receive a
-response from us within a few days. If the issue is confirmed, we will release a
+Please report security vulnerabilities to
+[GitHub Private Advisory](https://github.com/gotify/server/security)
+or **[gotify@protonmail.com](mailto:gotify@protonmail.com)**. You will receive a
+response from us within a few days. 
+
+If the issue is confirmed, we will release a
 patch as soon as possible.
+Additionally, we will submit findings that demonstrate the necessity for
+user triage and align to CNA vulnerability determination standards
+to the GitHub CNA Program.