Security: private coordinated disclosure ready (enable PVR or contact @macncrash)

Coordination request (no technical details here)

I have a private coordinated vulnerability report for ultraworkers/claw-code affecting sandbox isolation reporting and permission-mode persistence (HIGH). Report includes full write-up and suggested patches.

Private vulnerability reporting appears disabled on this repository (GET .../private-vulnerability-reporting → enabled: false), so I cannot file a GHSA report via the API.

Please either

1. Enable private vulnerability reporting so I can submit the full package via GitHub Security Advisories, or
2. Contact @macncrash / [email protected] and I will grant access to the private package repo or re-send the materials.

Private package (invite-only): https://github.com/macncrash/saudit-disclosure-claw-code-2026-07

I will not post exploit details, PoCs, or patches on this public issue.

Reporter: macncrash
AI-assisted analysis; findings human-verified. Local validation only.

Thank you.