Where should security issues be reported?

Hi — I could not find a security policy or contact for this repository, so I am asking here rather than guessing.

There is no SECURITY.md, GitHub's private vulnerability reporting is not enabled, and I could not find a contact address in the README or on the org profile. I have something I would like to report privately and no obvious route for it.

Three options, whichever suits you:

1. Enable private vulnerability reporting — Settings → Security → "Private vulnerability reporting". One checkbox, the report stays private, and it gives you a draft advisory you can publish (or not) once it is fixed.
2. Add a SECURITY.md with wherever you would like reports sent.
3. Reply here with an address and I will use that.

For transparency: I did find [email protected] in the commit metadata, but that is a personal address rather than a published security contact and I would rather not use it uninvited. Happy to send there if you say it is fine.

Nothing here is urgent or time-sensitive from my side, and I am not putting you on a disclosure clock. I would just rather this reach you privately than end up in a public issue.

Thanks.