Security contact request for CI/CD workflow report

Hello maintainers,

I found a potential CI/CD security issue in this repository during local static analysis. I do not want to disclose technical details in a public issue.

Could you please point me to a private security contact, GitHub private vulnerability reporting channel, or email address where I can share the report?

For safety: I have not opened a proof-of-concept PR, have not triggered your workflows, and have not attempted to access tokens, secrets, registries, deployments, or repository resources.

Thank you.

No repository file, test, or entry point is named because the reporter is requesting a private disclosure channel rather than a code change. Start by reviewing the repository's security-reporting options; done means providing a private contact or channel where the report can be safely shared.

Written by the indexing model from the issue text.