Security: request to open a private disclosure channel

[mohammedix88]

Hi — I'm a security researcher (mohammad adnan, CyStack red team). I've identified what I believe is a security issue in prometheus-client (affecting the current release) and would like to report it privately and responsibly. (Happy to use the Prometheus security list if you prefer.)

I couldn't find a private channel here: this repo's GitHub Private Vulnerability Reporting appears to be disabled (Security → Advisories → Report a vulnerability returns 404). Could you either:

1. Enable Private Vulnerability Reporting (Settings → Security → Private vulnerability reporting), or
2. Point me to the Prometheus security contact / preferred private channel?

I have a runtime-verified proof-of-concept and a suggested one-line fix ready to share privately. I'm deliberately not posting details here to avoid public exposure before a fix. Thank you!

[csmarchbanks]

See the security policy on the Prometheus page: https://prometheus.io/docs/operating/security/