SECURITY.md points to private advisory reporting, but it is not enabled on this repo

[Job28703]

SECURITY.md directs security reports to:

https://github.com/suboss87/fdeops/security/advisories/new

That endpoint is not usable by non-maintainers right now — private vulnerability reporting is not enabled for this repository. Attempting to submit a report returns:

HTTP 403: Repository does not have private vulnerability reporting enabled

So the documented channel currently has no working path behind it.

I have a security report for this project and would like to send it privately. It concerns hooks/session-start and is reproducible on current main (c8e283b, 3.9.8). I am deliberately not including details here, since a public issue would publish the technique before a fix exists. Severity in my own assessment is moderate — no privilege escalation, but the effect persists across sessions once triggered.

Two things would each unblock it:

1. Enable private vulnerability reporting (Settings → Code security and analysis → Private vulnerability reporting). This also makes SECURITY.md accurate.
2. Or tell me any contact route you prefer and I will send the write-up there.

The report includes a reproduction, a suggested patch, and verification notes (the full test suite passes with the patch applied). Happy to send it whenever you have a channel open.

Unrelated: I filed #8 separately — that one is an ordinary bug, not a security issue, so it went the public route.

[Job28703]

Gentle ping — this has been open a day with no response, and I wanted to flag it in case the notification got missed. Re-checked just now and private vulnerability reporting is still disabled on this repo:

$ gh api repos/suboss87/fdeops/private-vulnerability-reporting
{"enabled": false}

Happy to wait if you're just busy — no rush on my end. If it's easier, an email or other contact method works too; I have a few more findings queued (not disclosed here since they're security-relevant) that I'd rather send through a private channel once one is available.