Security: requesting a private disclosure channel

Hi maintainers,

We found what we believe is a security-relevant issue in the default configuration of DockerWorkspace/DockerDevWorkspace (the documented sandbox launcher). We'd like to report it responsibly rather than posting full details in a public issue.

This repository doesn't currently have GitHub's private vulnerability reporting enabled and has no SECURITY.md. Could you either enable private vulnerability reporting (Settings -> Security -> Enable), or point us to a security contact email? Happy to share the full technical writeup as soon as there's a private channel available.

Actual Behavior

Running the SDK's own documented example for a Docker-sandboxed agent server, using its default configuration with no extra setup, results in the agent server being reachable over the network with no authentication required for its request-execution API. We believe this affects the standard DockerWorkspace/DockerDevWorkspace launch path, not a misconfiguration on our end.

Acceptance Criteria

• Maintainers confirm a private channel (GitHub PVR or a security contact email) so we can share full reproduction steps and the affected code paths.
• Default configuration is reviewed so an agent server started via the documented example does not expose an unauthenticated network-reachable execution API.

Thanks!

Start with the documented Docker-sandboxed agent server example and the default DockerWorkspace/DockerDevWorkspace launch paths. First establish a private disclosure channel for the withheld reproduction details; done means maintainers can review the affected code paths and confirm that the default example does not expose an unauthenticated network-reachable execution API.