diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index 927a026..71985a9 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -1,8 +1,8 @@
 blank_issues_enabled: false
 contact_links:
   - name: Security vulnerability
-    url: https://github.com/swaits/heuropt/security/advisories/new
-    about: Please use private vulnerability reporting — do not open a public issue. See SECURITY.md.
+    url: https://git.swaits.com/swaits/heuropt/src/branch/main/SECURITY.md
+    about: Do not open a public issue. Email steve@waits.net — see SECURITY.md.
   - name: Question / discussion
-    url: https://github.com/swaits/heuropt/discussions
-    about: For open-ended questions or design discussions.
+    url: https://git.swaits.com/swaits/heuropt/issues
+    about: For open-ended questions or design discussions, open an issue and label it "question".
diff --git a/SECURITY.md b/SECURITY.md
index 34cf240..04cbc35 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -17,14 +17,15 @@ minor versions.
 
 ## Reporting a vulnerability
 
-Please **do not** open a public GitHub issue for a security bug.
-Instead use one of these channels:
+Please **do not** open a public issue for a security bug.
+Instead:
 
-- GitHub's [private vulnerability reporting](https://github.com/swaits/heuropt/security/advisories/new)
-  on the repository.
 - Email **steve@waits.net** with subject line `[heuropt security]
   <short summary>`.
 
+(This project is hosted on [git.swaits.com](https://git.swaits.com/swaits/heuropt),
+which has no private-advisory feature, so email is the reporting channel.)
+
 Please include:
 
 1. A description of the vulnerability and the affected versions.