Security Contact Request - Potential vulnerabilities to report

[devatsecure]

Hi maintainers,

During a security review, we identified some potential security issues that we would like to report responsibly:

1. API Authorization: Possible missing authorization checks in session-related endpoints
2. Dependency Updates: Several dependencies have published security advisories with available fixes

We have detailed findings ready to share privately. Could you please provide:

• A security contact email, OR
• Confirm we can share details in this discussion, OR
• Enable GitHub Private Vulnerability Reporting

We are committed to responsible disclosure and will not publish details publicly until patches are available.

Thank you for your time!

---

This is a good-faith security report. No exploit details are included in this message.

[stdrc]

Hi! Thanks for your reporting. We just enabled Private Vulnerability Reporting and added a secutiry policy.

[spartan8806]

@stdrc — following up on this thread since you're the one who set up private reporting back
in February.

That channel works, and I used it: I filed a report through the Security page on 19 July,
and pushed a suggested fix as a pull request on the private advisory fork GitHub creates
for the advisory. Both are still sitting there unread as far as I can tell. No complaint
intended — I know what 831 open issues looks like.

Not putting any details here, since it isn't something that should be public yet.

One thing that's genuinely worth knowing, and is the reason I'm posting rather than just
waiting: pull requests opened on a private advisory fork do NOT appear in the repository's
normal pull request list. They're only visible from inside the advisory itself. So a
finished fix can sit there indefinitely without anyone realising it exists — which I think
may be what's happened here.

If there's a better contact than the advisory queue, I'm happy to use it. Otherwise no
rush at all, and nothing will be made public from my side.

Thanks for setting the channel up in the first place — a lot of projects never do.

Conner (github.com/spartan8806)