How should I contact you in private if I find something?

You don't have a Github repository where I can create a security advisory and I don't see something here like we have here (see https://securitytxt.org/).

Is a mail to hello@orangepillapp.com good enough? I don't know if that mail might be read by the wrong employees.