[Security] Coordinated disclosure pending — please enable PVR or confirm private channel

[eddieran]

Hi maintainers,

I've completed a security audit of mayfly-go and have findings I'd like to share privately. Asking here because:

1. The repo doesn't have SECURITY.md documenting a private channel.
2. Private Vulnerability Reporting (GitHub's free private security advisory channel) appears to be disabled — I checked GET /repos/dromara/mayfly-go/private-vulnerability-reporting and it returns enabled: false.

I'd like to keep vuln details out of public issues so attackers can't get a head-start before a fix lands. Two options:

• Option A (preferred): Enable Private Vulnerability Reporting via Settings → Code security → Private vulnerability reporting → Enable. Free, hides triage discussion from the public, and gives me a structured GHSA channel for the report.
• Option B: Confirm a preferred private channel (email or otherwise) and I'll route there.

Two findings ready to share — both with concrete PoC + suggested patches. Happy to wait at your pace. No disclosure clock.

For context: this is part of a broader coordinated-disclosure campaign that has filed 20 advisories via the GHSA reporter API across 9 maintainer orgs over the past two weeks (1Panel-dev, mudler/LocalAI, donknap/dpanel, nezhahq/nezha, IceWhaleTech/CasaOS-Gateway, henrygd/beszel, amir20/dozzle, crowdsecurity/crowdsec, 1Panel-dev's KubePi). All 20 are in triage state today; none have been published or weaponized.

Thanks!

— Eddie Ran

[eddieran]

Update — I've taken the GitHub-native path for the "no SECURITY.md" half of this:

• PR chore: add SECURITY.md (private vulnerability reporting policy) #129 — adds a draft SECURITY.md to the repo, modelled on the standard GitHub template that the Security and quality tab's "Suggest a policy" prompt offers. Once merged + PVR is enabled, I can file my disclosure through the structured private channel.

So rather than waiting on this issue alone, the maintainer flow is:

1. Review/edit/merge chore: add SECURITY.md (private vulnerability reporting policy) #129 (the SECURITY.md draft).
2. Enable Private Vulnerability Reporting in Settings → Code security.
3. Tell me to file via PVR (or via whatever private channel you settle on in SECURITY.md).

I'll watch #129. Closing this issue once it lands seems reasonable — or you can leave it open as the tracker. Up to you.

Thanks!