Security hardening — requesting private disclosure channel

Hi, I found a security-relevant issue related to model checkpoint loading that I'd like to report responsibly rather than describe in detail publicly. This repo doesn't have GitHub's private vulnerability reporting enabled, so I don't have a private channel to send details through.

Could you either:

1. Enable "Private vulnerability reporting" under Settings → Security → Code security (this lets me submit a full private advisory directly), or
2. Share a preferred contact (email, etc.) I can use instead?

Happy to provide full details as soon as there's a private channel. Thanks for maintaining this project!