The security process on GitHub points to here. That site says
You’ll receive an email reply from Swift.org to acknowledge that we received your report, and we’ll contact you if we need more information.
I got no confirmation (or bounce) email. I've sent my report more than a month ago.
There is unfortunately a huge amount of spam that gets sent to that address. Thanks for following up here.
@tkremenek Cyberbeni/spm-cache-poisoning: Demonstration of Swift Package Manager cache poisoning - Codeberg.org
The security policy has been updated to use GitHub's vulnerability reporting:
Thank you for highlighting that the forum reporting wasn't being nearly as effective as necessary.