Request for a private security contact (unauthenticated vulnerability)

Hi maintainers - I've found a high-severity, unauthenticated security issue in the API server and would like to disclose it responsibly. I'm not posting details here to avoid exposing users. Could you enable GitHub private vulnerability reporting (Settings → Security → "Private vulnerability reporting"), or share a security email so I can send the full write-up and a local proof-of-concept privately? I'd appreciate credit to Moshe Levi (LevinityCyber), GitHub: hackking007. Thanks.