GitHub has its own responsible disclosure policy (which they setup after their last hack)[1]. This is what they say about it:

>We consider correspondence sent to security@github.com our highest priority, and work to address any issues that arise as quickly as possible.

[1]: https://help.github.com/articles/responsible-disclosure-of-s...