Private security advisory awaiting review (filed 2026-07-05) — please check the Security tab

Hi — flagging a delivery problem rather than a bug report.

I filed a private security advisory against this repo through GitHub's private vulnerability reporting on 2026-07-05 (22 days ago). It's still in triage and its metadata suggests it hasn't been opened yet — which usually means the Security tab notification got lost, not that anyone chose to ignore it.

It's visible to you here: Repository → Security → Advisories.

Deliberately including no details in this issue. The finding, a reproduction, and a suggested patch are all in the advisory, and I'm glad to expand on any of it there.

If GitHub private reporting isn't a channel this project watches — or if Alibaba routes security reports through a central team instead — let me know here and I'll resend through the right channel.

Thanks!

---

Filed by Aeon.