Security vulnerability report — requesting private disclosure channel

Hi, I found a security issue (SSRF via insecure default configuration) in the rendering API that I'd like to report responsibly rather than describe it publicly. This repo doesn't have GitHub's private vulnerability reporting enabled, so I don't have a private channel to send details through.

Could you either enable Private vulnerability reporting under Settings, Security, Code security, which lets me submit a full private advisory directly, or share a preferred contact such as an email I can use instead?

Happy to provide full reproduction details as soon as there's a private channel. Thanks for maintaining this project!