Repository navigation
[Security] Request for a private vulnerability reporting channel #160
Description
Per SECURITY.md ("GitHub private vulnerability reporting is not currently
enabled... open an issue without vulnerability details asking maintainers for
a private channel"), this issue contains no vulnerability details.
I have two verified security findings against mcode 0.4.12 (Linux, Node 26):
- a terminal-output handling issue in the TUI render path (this one is the
more serious of the two) - an issue in how the agent's file tools interact with mcode's own
credential storage
Both have minimal reproductions and redacted evidence ready, neither involves
real credentials, and neither is currently discussed anywhere public.
Since the repo's private vulnerability reporting is not enabled and no
security email is listed, could you either enable Security → Advisories →
Report a vulnerability, or point me at an alternative private channel? Once
one exists I will submit the full write-ups there.
cc @hetaoBackend (release coordinator per docs/maintainers.md)
Activity
hetaoBackend commentedon Sep 18, 2026
Thanks for flagging this and for keeping the vulnerability details private. Please contact me directly at ronny@minimax.io with the write-ups, minimal reproductions, and redacted evidence for both findings.
superbigcup325 commentedon Sep 19, 2026
Just a heads-up: the detailed write-up covering both findings was sent to ronny@minimax.io on Sep 19, from the mailbox tied to this GitHub account (happy to verify identity here if needed).
Treating it as 90-day coordinated disclosure starting from that date. Let me know if anything else is needed on my side.
(If you'd rather keep this off the public tracker, feel free to confirm by email instead.)
hetaoBackend commentedon Sep 19, 2026
Thanks, @superbigcup325 — confirming that I have received your email covering both findings. I have noted your proposed 90-day coordinated disclosure window starting September 19, 2026. We will follow up by email on reproduction materials, next steps, and disclosure timing, keeping the technical details private. Thank you for reporting these responsibly and offering to help with verification.
hetaoBackend commentedon Sep 19, 2026
Closing this channel-request issue as completed: a private reporting channel was provided, and receipt of the report has already been confirmed above. We will continue following up on the findings and coordinated disclosure by email. This closes only the request for a private reporting channel; it does not indicate that either reported vulnerability has been fixed.
hetaoBackend commentedon Sep 19, 2026
Thanks again, @superbigcup325. We reproduced both findings with an isolated local provider and synthetic data, and fixes have now been merged into
mainvia #191 (commit 81b666a).Our before/after checks on source-built artifacts confirm that the reproduced behaviors are addressed with permission checks enabled, while explicitly approved access continues to work. The merged changes match the locally tested revision, and the PR's Linux, macOS, and Windows verification jobs all passed.
This confirmation applies to the repository source. We will coordinate package availability and disclosure timing separately by email. Please send any retest results or remaining concerns through the same private channel. We appreciate your responsible report and help with verification.