Not for a public project... And github got rid of their private messaging system, suggesting that people email the package maintainers instead. So, the preferre

Not for a public project... And github got rid of their private messaging system, suggesting that people email the package maintainers instead. So, the preferred route would probably be to do that. gov.uk could have an email address that functions as the front end to a private bug tracker.