Where should security vulnerabilities be reported?

[mosajjal]

Hi maintainers — I'd like to report a potential security issue but couldn't find a private channel:

• No SECURITY.md / security policy in the repo
• GitHub Private Vulnerability Reporting ("Report a vulnerability") isn't enabled
• Issues are restricted to reproducible bugs and blank issues are disabled, so a public issue isn't appropriate for an unfixed vulnerability

Where would you like security vulnerabilities reported? Would you consider enabling Private Vulnerability Reporting (repo Settings → Security → Reporting) or adding a SECURITY.md with a contact? Happy to share details privately once there's a channel. Thanks!

[ogulcancelik]

Thanks for flagging this. I've enabled GitHub Private Vulnerability Reporting for the repository. Please submit the details through the private vulnerability report form, and we’ll review them there.