The person/account on XZ repo also altered the security disclosure policy on that and other repos they author in months prior.