Hi — we've been evaluating hermesworkers and have a handful of security-hardening findings we'd like to report responsibly.
Your SECURITY.md points to GitHub's "Report a vulnerability" flow, but Private Vulnerability Reporting appears to be disabled on the repo (Settings → Code security → Private vulnerability reporting), so that button isn't available.
Could you enable it, or share a private contact? We already have fixes implemented and tested, and we're happy to open PRs however you'd prefer to stage them (we saw the issue-first / one-concern-per-PR guidance in CONTRIBUTING).
Thanks!
Hi — we've been evaluating hermesworkers and have a handful of security-hardening findings we'd like to report responsibly.
Your SECURITY.md points to GitHub's "Report a vulnerability" flow, but Private Vulnerability Reporting appears to be disabled on the repo (Settings → Code security → Private vulnerability reporting), so that button isn't available.
Could you enable it, or share a private contact? We already have fixes implemented and tested, and we're happy to open PRs however you'd prefer to stage them (we saw the issue-first / one-concern-per-PR guidance in CONTRIBUTING).
Thanks!