Security vulnerability report — requesting private disclosure channel

Hi, I found a security issue (SSRF via insecure default configuration) in the rendering API that I'd like to report responsibly rather than describe it publicly. This repo doesn't have GitHub's private vulnerability reporting enabled, so I don't have a private channel to send details through.

Could you either enable Private vulnerability reporting under Settings, Security, Code security, which lets me submit a full private advisory directly, or share a preferred contact such as an email I can use instead?

Happy to provide full reproduction details as soon as there's a private channel. Thanks for maintaining this project!

Do not add vulnerability details publicly. Check the repository's Settings > Security > Code security area to see whether Private vulnerability reporting can be enabled; otherwise arrange a maintainer-provided private contact. Done means the reporter has a private channel for submitting full reproduction details.

Written by the indexing model from the issue text.