Security: requesting a private disclosure channel

Hi maintainers,

We found what we believe is a security-relevant issue related to the recent web-server hardening work (around PR #1468/#1471) — specifically a gap in the same endpoint area that appears to have been missed by that hardening pass.

This repository doesn't currently have GitHub's private vulnerability reporting enabled. Could you either enable it (Settings -> Security -> Enable), or point us to a security contact email? Happy to share the full technical writeup as soon as there's a private channel available.

Thanks!