diff --git a/SECURITY.md b/SECURITY.md
index 53b97afb..04a13798 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -17,6 +17,10 @@ Include what you have:
 
 Partial reports are welcome. We would rather triage something incomplete than never hear about it.
 
+## Security contact
+
+Rock Lambros ([rock.lambros@owasp.org](mailto:rock.lambros@owasp.org)) is the project's named security contact. Send reports through private vulnerability reporting above, so every maintainer sees them and the report stays tracked. Write to this address to reach a person about a report you already filed, or if private vulnerability reporting is unavailable to you.
+
 ## What is in scope
 
 | In scope | Out of scope |
diff --git a/tests/test_roadmap_model_roster.py b/tests/test_roadmap_model_roster.py
index fe973b58..bb17bb2b 100644
--- a/tests/test_roadmap_model_roster.py
+++ b/tests/test_roadmap_model_roster.py
@@ -227,3 +227,21 @@ def test_real_governance_names_the_three_project_leads_and_the_volunteers():
     assert project_lead_logins(roster) == frozenset({"rocklambros", "afogel", "bar-capsule"})
     assert ("Victor Hernandez", "victorm-hernandez") in roster.triage_volunteers
     assert "victorm-hernandez" in trusted_logins(REPO_ROOT)
+
+
+def test_a_name_may_carry_a_parenthesized_nickname():
+    text = (
+        "## Project leads\n\n| Role | Name |\n| --- | --- |\n"
+        "| Project Lead | Kyriakos Lambros (Rock) ([@rocklambros](https://github.com/rocklambros)) |\n"
+        "| Project Lead | Ariel Fogel ([@afogel](https://github.com/afogel)) |\n\n"
+        "## Workstream leads\n\n| Workstream | Leads |\n| --- | --- |\n"
+        "| Development (SDK) | Kyriakos Lambros (Rock) ([@rocklambros](https://github.com/rocklambros)), "
+        "Fred Wilmot ([@fewdisc](https://github.com/fewdisc)) |\n\n"
+        "## Triage volunteers\n\n| Volunteer | Assigned by |\n| --- | --- |\n"
+        "| Victor Hernandez ([@victorm-hernandez](https://github.com/victorm-hernandez)) | Kyriakos Lambros (Rock) |\n\n"
+        "## Origins\n\nMichael Bargury ([@mbrg](https://github.com/mbrg)) created ACS.\n"
+    )
+    roster = parse_governance(text)
+    assert roster.project_leads == (("Kyriakos Lambros (Rock)", "rocklambros"), ("Ariel Fogel", "afogel"))
+    assert ("Kyriakos Lambros (Rock)", "rocklambros") in roster.workstreams["Development (SDK)"]
+    assert ("Victor Hernandez", "victorm-hernandez") in roster.triage_volunteers
diff --git a/tools/roadmap_model.py b/tools/roadmap_model.py
index 8e6cd742..af69a925 100644
--- a/tools/roadmap_model.py
+++ b/tools/roadmap_model.py
@@ -34,7 +34,9 @@ class RosterError(ValueError):
 
 _OWNER_TOKEN = re.compile(r"^@[A-Za-z0-9-]+$")
 _LINK = re.compile(r"\[@([^\]]+)\]\(https://github\.com/([^)/\s]+)\)")
-_PERSON = re.compile(r"([^,()|]+?)\s*\(\[@([^\]]+)\]\(https://github\.com/([^)/\s]+)\)\)")
+# A name may carry one parenthesized part, such as a nickname in "Kyriakos Lambros (Rock)".
+# The group refuses a parenthesis that opens the handle link, so the name ends there.
+_PERSON = re.compile(r"((?:[^,()|]|\((?!\[@)[^()|]*\))+?)\s*\(\[@([^\]]+)\]\(https://github\.com/([^)/\s]+)\)\)")
 _SPLIT_CELLS = re.compile(r"(?<!\\)\|")