As per k/dev discussion SIG repos need a SECURITY_CONTACTS file and SIG charters need a section describing their security contacts.
This could be a great new contributor starting point: if there’s a SIG in which you’re involved and they have not yet documented this, you could be the wood chopper / water carrier to open an issue, bring the topic up at the next SIG meeting, collect the names of volunteers and their commitment to abide the embargo policy, and then PR the SIG’s decision for contacts into the SIG repo and charter.