No private channel to report a security issue (no SECURITY.md, private reporting disabled) #104

There is no private channel to reach you on

CodeWiki has more than 1,700 stars, runs against whatever repository it is pointed at, and drives local agent CLIs on a developer's machine. Someone will eventually need to tell you something they would rather not open an issue about.

Right now there is nowhere to send it:

• SECURITY.md - not present.
• Private vulnerability reporting - the API reports it as disabled for this repository.

So the only available route is a public issue, which is the wrong shape for anything that should be fixed before it is described.

Why I am asking now

I read through the codebase this week, and I have something specific I would rather send you privately than write in a public thread. That is the whole reason for this issue: I went looking for the channel before saying anything, and there isn't one.

This issue is not that report, and I am not going to hint at its contents here. Some of what I found is ordinary improvement work that needs no privacy, and I am glad to open it as normal pull requests if useful. What is left over is the part I am holding.

If you would rather I just open it as a normal issue or send a PR, say so and I will do that the same day - it is your call. I would only like it to be a decision you made, rather than the only option the repository currently leaves open.

What would fix it

GitHub's built-in private reporting is a checkbox, needs no infrastructure, and gives you a private thread plus a draft advisory: Settings → Code security and analysis → Private vulnerability reporting → Enable. A short SECURITY.md pointing at it, with the response time you actually want to promise, is enough.

One unrelated thing, since it is the same kind of gap

README.md and pyproject.toml both declare MIT, but there is no LICENSE file in the repository, so GET /repos/FSoft-AI4Code/CodeWiki/license returns 404 and GitHub shows no license. For an ACL-cited project that people will vendor, adding the file makes the declared licence the actual one. Happy to open a separate PR for it if that is easier.

Avp9.