Security disclosure contact requested #2984

Hi! I ran a source-only security review of this repository and found three security-hardening items that look worth maintainer review.

I do not see a SECURITY.md, and GitHub private vulnerability reporting appears to be disabled for this repository. Is there a preferred private disclosure channel where I can send the details?

I am intentionally not including technical details here to avoid public disclosure before a maintainer has a chance to triage.