Security: request to open a private disclosure channel

[mohammedix88]

Hi — I'm a security researcher (mohammad adnan, CyStack red team). I've identified what I believe is a security issue in bbcode (affecting the current release) and would like to report it privately and responsibly.

I couldn't find a private channel: this repo's GitHub Private Vulnerability Reporting appears to be disabled (Security → Advisories → Report a vulnerability returns 404) and I didn't find a SECURITY.md contact. Could you either:

1. Enable Private Vulnerability Reporting (Settings → Security → Private vulnerability reporting), or
2. Share a security email / preferred private channel?

I have a runtime-verified proof-of-concept and a suggested one-line fix ready to share privately. I'm deliberately not posting details here to avoid public exposure before a fix. Thank you!

[dcwatson]

I've enabled private reporting.

[mohammedix88]

Thanks for enabling private reporting, @dcwatson — I appreciate it.

In the interest of not wasting your time: I went back and re-verified against the current release before sending anything, and I could not reproduce a practical denial of service. The URL auto-link regex (_url_re) handles the payloads I'd flagged in linear time (an 80 KB worst-case input renders in ~9 ms), so there's no catastrophic backtracking to report here. My earlier concern didn't hold up on re-testing.

So there's nothing actionable from me on this one — feel free to close the issue. Sorry for the noise, and thanks again for the quick, responsible response.