Where should security issues be reported?

[spartan8806]

Hi — I could not find a security policy or contact for this repository, so I am asking here rather
than guessing.

There is no SECURITY.md, GitHub's private vulnerability reporting is not enabled, and I could not
find a contact address in the README or on the org profile. I have something I would like to report
privately and no obvious route for it.

Three options, whichever suits you:

1. Enable private vulnerability reporting — Settings → Security → "Private vulnerability
   reporting". One checkbox, the report stays private, and it gives you a draft advisory you can
   publish (or not) once it is fixed.
2. Add a SECURITY.md with wherever you would like reports sent.
3. Reply here with an address and I will use that.

For transparency: I did find yijia-xiao@outlook.com in the commit metadata, but that is a personal
address rather than a published security contact and I would rather not use it uninvited. Happy to
send there if you say it is fine.

Nothing here is urgent or time-sensitive from my side, and I am not putting you on a disclosure
clock. I would just rather this reach you privately than end up in a public issue.

Thanks.

[LudwigJMarx]

Not a maintainer — just a contributor working through the tracker. I checked, and the situation is
still exactly as you describe it:

community/profile → .files.security   = null
private-vulnerability-reporting       = {"enabled": false}

I have opened #1359 with a SECURITY.md that routes reports to GitHub's private vulnerability
reporting.

To be straight with you about what that does and does not solve: the file alone does not give you
a route. Private vulnerability reporting has to be switched on by someone with admin access
(Settings → Advanced Security → Private vulnerability reporting), and until that happens the link in
the policy will not resolve. What the PR hopefully changes is that this stops being an open question
and becomes a single checkbox with the wording already written.

I did not put the yijia-xiao@outlook.com address from the commit metadata into the file, for the
same reason you chose not to use it uninvited — it was never published as a security contact, and
that is not a contributor's call to make.

@Yijia-Xiao — if you would rather take reports by email than through GitHub, that is a one-line
change and I am glad to push it to the PR.

Until one of those is in place, I would hold what you have rather than putting details here. Thanks
for raising it the careful way round.