[Security] Enable private vulnerability reporting — the published contact link is dead

[jongan69]

Problem

.github/ISSUE_TEMPLATE/config.yml publishes a security contact link:

- name: Security vulnerability
  url: https://github.com/jongan69/opendating-mobile/security/advisories/new
  about: Report security issues privately; never include keys, private messages, or personal data in a public issue.

But private vulnerability reporting is not enabled on this repo:

$ gh api /repos/jongan69/opendating-mobile/private-vulnerability-reporting
{"enabled":false}

Non-maintainers who follow that link cannot open a private advisory. Since blank_issues_enabled: false and this is the only security route offered, a reporter's realistic options are a public issue or silence — and the config text explicitly tells them not to put sensitive detail in a public issue.

For a dating app whose threat model centers on private keys, DMs, and location, a security reporting path that silently does not work is worth closing before launch.

Fix

Enable private vulnerability reporting in Settings → Code security and analysis, or change the contact link and warning text to route reports through a private path that does work.

Provenance

Raised by CodeRabbit on #6 and never actioned; re-verified still failing during the PR/issue audit. Full context in #7.