Private write-only category for security bugs

We use HackerOne

You can use the group inbox feature for that. User can either PM or email a security group that will be the only who can see/reply those messages.