Per the ASF Security Process, you must not make information about a vulnerability in your own code public until it is formally announced at the end of that process. That means, for example, that you should not create a public Jira ticket to track the issue, or a public GitHub issue, since those would make the issue public. Messages associated with any commits should not make any reference to the fact that it fixes a vulnerability.
Generally, the preferred approach to this is to still use the public commit and review process, but without leaking the security impact of the change. Best is when you can combine the security-relevant change with a general cleanup or refactor that obscures it. Alternatively, for the kind of issues that are easy to find with vulnerability scanning tools, it might be inevitably obvious that a given change is a 'security-related' change, but you could leave the fact that this is actually an exploitable vulnerability rather than a 'defense-in-depth hardening improvement' obscured.
In any case, once the fix is public, there is a chance that 3rd parties will realize the security impact, so it is wise to start planning your next release without too much delay.
In rare situations where there is an unusually high risk of damage when the fix leaks prematurely, where it is impossible to obscure the security impact, or where it might not be possible to perform a release on a short timeframe, you can work 'fully' in private by discussing the patches on your private mailinglist and committing them 'just before' the release. Note that changes getting committed 'just before' a release might also make them more interesting to observers.
For highly sensitive situations, think Log4J CVE-2021-44228 class events, you might even want to do a shorter public voting period. In such a case you'd ideally do a 'private' coordination / voting / staging round within the PMC to make sure everything is in place and ready to go, so you can responsibly shorten the public vote. See https://lists.apache.org/thread/ckr7t4qohcwlk0cz0zf8l39op6mtjgop for some background.