Private Sourceforge bugs are posted to docutils-develop

I've noticed that private bugs are announced on this list, making the
private checkbox in the Sourceforge bug tracker ineffictive.

I think I successfully canceled the previous attempt to post a private
bug of mine here.  Is there are more reliable way to report security
issues privately?

(The issues I've been asked to report probably do not need to handled
privately in my personal opinion, but I've been specifically instructed
not to report them publicly, and would have to obtain permission from
our security team before posting them to this list, for example.)

Thanks,
Florian