Private security disclosure route?

[dodge1218]

Private security disclosure route?

Hi,

I have a security report on postrv/forgemax that I'd like to share through a private channel.

I checked:

• SECURITY.md says to email "the repository maintainers via the contact information in the repository" but I couldn't find an explicit email address in the repo or your GitHub profile.
• GitHub Private Vulnerability Reporting is disabled for this repo (per gh api /repos/postrv/forgemax/private-vulnerability-reporting → enabled: false).

Could you:

1. Confirm a working private security email, or
2. Enable GitHub Private Vulnerability Reporting on this repo so I can file there?

The finding is Medium-severity (a security guarantee documented in your SECURITY.md is bypassable in source). 90-day disclosure window from first contact. Happy to coordinate on whichever channel works.

Thanks,
Ryan Vonbrubeck (@dodge1218 / vonbrubeck@gmail.com)

[postrv]

Hi @dodge1218 apologies for the delay - I didn't see this - I've enabled private vulnerability reporting on the repo. Appreciate the reach out!

Best,

Laurence