Security: request for a private disclosure contact

Hi,

I've found what I believe is a security issue in how LMFlow loads a model during inference, and I'd like to report it privately and responsibly.

This repository doesn't have a SECURITY.md or GitHub Private Vulnerability Reporting enabled, so could you either share a security contact email, or enable "Private vulnerability reporting" under Settings → Security → Advisories?

I'm keeping details out of this public issue on purpose. I'll send a full write-up and a proof-of-concept as soon as there's a private channel. Thanks!