docs(security): add dev@sub2api.org as fallback reporting email

.github/SECURITY.md

@@ -14,6 +14,8 @@ Report them privately through GitHub's private vulnerability reporting:
 
 (Repository → **Security** tab → **Report a vulnerability**.) Only the maintainers can see the report, and the advisory becomes the place to discuss, fix, and eventually publish the issue.
 
+If you cannot use GitHub private vulnerability reporting, email **dev@sub2api.org** instead, with `[Security]` in the subject line.
+
 A useful report includes:
 
 - The affected component and version (release tag or commit)
@@ -64,6 +66,8 @@ Please keep details private until the advisory is published. This is a volunteer
 
 （仓库 → **Security** 标签页 → **Report a vulnerability**。）报告仅维护者可见，后续的讨论、修复与公告发布都在该安全公告中进行。
 
+如果无法使用 GitHub 私密漏洞报告，也可以发送邮件至 **dev@sub2api.org**，邮件标题请注明 `[Security]`。
+
 报告中建议包含：
 
 - 受影响的组件与版本（Release tag 或 commit）