Repository navigation
Security: request to open a private disclosure channel #91
Description
Hi — I'm a security researcher (mohammad adnan, CyStack red team). I've identified what I believe is a stored-XSS issue in python-textile's restricted mode (affecting the current release) and would like to report it privately and responsibly.
I couldn't find a private channel: this repo's GitHub Private Vulnerability Reporting appears to be disabled (Security → Advisories → Report a vulnerability returns 404) and I didn't find a SECURITY.md contact. Could you either:
- Enable Private Vulnerability Reporting (Settings → Security → Private vulnerability reporting), or
- Share a security email / preferred private channel?
I have a runtime-verified proof-of-concept and a one-line fix ready to share privately. I'm deliberately not posting details here to avoid public exposure before a fix. Thank you!
Activity
ikirudennis commentedon Aug 18, 2026
I've enabled the Private Vulnerability Reporting option. I'm not entirely familiar with it myself, so I don't know if there's more setup for me to do, but please give it a try and let me know if there's anything else that needs to be enabled as well.
mohammedix88 commentedon Aug 18, 2026
Thanks @ikirudennis — I've just submitted the full report through Private Vulnerability Reporting (it's under Security → Advisories on your end). Nothing else needed from you to receive it; you'll see it as a draft advisory with the runtime PoC and a one-line fix. Happy to answer any questions there. Appreciate the quick response!