Security: requesting a private channel to report a critical vulnerability (no details here)

[circlecrystal]

Hi maintainers 👋

I've identified what I assess as a critical-severity security vulnerability in BitFun, reproduced against the current main branch.

I'm intentionally withholding all technical details here — no affected file, component, mechanism, or proof-of-concept — because publicly disclosing an unpatched issue would put current users at risk. This follows the project's own SECURITY.md / coordinated-disclosure policy.

I already have a complete report ready to share privately, including:

• Root-cause analysis and the exact location
• A working, self-contained proof-of-concept
• CVSS 3.1 scoring
• A proposed patch (diff) plus a regression test

What I need to proceed: a private channel. Right now the repo's /security/advisories/new link isn't usable by non-maintainers because Private Vulnerability Reporting appears to be disabled. Please do one of:

1. Enable Private Vulnerability Reporting — repo Settings → Code security and analysis → Private vulnerability reporting → Enable. I'll then submit the full report through GitHub Security Advisories; or
2. Reply with a private security contact (e.g. a security email) I can send the report to.

Once a private channel is open I'll hand over everything immediately, and I'm happy to coordinate a disclosure timeline after you've had a chance to review and patch.

Flagging as high priority given the severity. Thanks for building BitFun! 🙏

[circlecrystal]

（中文版 / Chinese version）

各位维护者好 👋

我在 BitFun 中发现了一个我评估为致命级（Critical）的安全漏洞，已在当前 main 分支上复现。

我在此刻意不公开任何技术细节——不涉及受影响的文件、组件、机制或概念验证（PoC）——因为在补丁发布前公开披露未修复的问题会让现有用户面临风险。这也遵循本项目自身的 SECURITY.md / 协调披露策略。

我已经备好一份可私密交付的完整报告，包含：

• 根因分析与精确位置
• 一份可独立编译运行的概念验证（PoC）
• CVSS 3.1 评分
• 一份修复补丁（diff）以及配套回归测试

我需要的只是一个私密通道。 目前该仓库的 /security/advisories/new 入口对非维护者不可用，因为 Private Vulnerability Reporting（私密漏洞上报）似乎尚未开启。请二选一：

1. 开启 Private Vulnerability Reporting —— 仓库 Settings → Code security and analysis → Private vulnerability reporting → Enable。开启后我会通过 GitHub Security Advisories 提交完整报告；或
2. 回复一个私密安全联系方式（例如安全邮箱），我将报告私下发送过去。

私密通道一旦开通，我会立即把全部内容移交，并乐意在你们完成审阅与修复后协调披露时间线。

鉴于其严重程度，标记为高优先级。感谢你们打造了 BitFun！🙏