They know to look for a link to the security page.

Github's is in their site footer.

37signals' is in their site footer.

Twitter's is linked off the sidebar in their "About" page.

Google's and Facebook's are the top search result for their site and "vulnerability" "security".

These are all fine options.