Hi — a security-process request, deliberately with no technical detail in it.
I have a security finding to report in FedML and there is currently no way to send it privately: private vulnerability reporting is disabled on this repository (/security/advisories/new returns 404) and there is no SECURITY.md with a contact address.
That leaves a researcher choosing between staying silent and describing the issue in a public issue where anyone can read it before there is a fix. Neither is good for the people running FedML, so I am asking for the channel rather than using either.
The ask: Settings → Advanced Security → Private vulnerability reporting → Enable. It takes a few seconds and costs nothing.
Why this is worth those seconds. FedML already has two CVEs assigned this year (CVE-2026-5535 and CVE-2026-5536), both recorded as having been reported without a response. Both were published as unreviewed records with no package metadata, which means dependency scanners cannot match them and your users get no automated signal at all. A private channel plus a published advisory fixes that: an advisory feeds OSV and Dependabot, and a CVE can be requested directly from it.
Happy to do the work. If you enable reporting I will file a complete report through it — affected files and lines, CVSS vector, affected version range, and references — written so you can review and publish rather than having to write it up yourselves. I will also state plainly which parts I have verified by reading the released source and which I have not tested at runtime, so nothing is taken on trust.
If maintaining this repository is no longer a priority, that is a fair answer too — even a SECURITY.md naming an email address, or archiving with a pointer to a successor, would be better for users than the current silence.
No deadline from my side.
— Mohammad Adnan (CyStack)
Hi — a security-process request, deliberately with no technical detail in it.
I have a security finding to report in FedML and there is currently no way to send it privately: private vulnerability reporting is disabled on this repository (
/security/advisories/newreturns 404) and there is noSECURITY.mdwith a contact address.That leaves a researcher choosing between staying silent and describing the issue in a public issue where anyone can read it before there is a fix. Neither is good for the people running FedML, so I am asking for the channel rather than using either.
The ask:
Settings → Advanced Security → Private vulnerability reporting → Enable. It takes a few seconds and costs nothing.Why this is worth those seconds. FedML already has two CVEs assigned this year (CVE-2026-5535 and CVE-2026-5536), both recorded as having been reported without a response. Both were published as unreviewed records with no package metadata, which means dependency scanners cannot match them and your users get no automated signal at all. A private channel plus a published advisory fixes that: an advisory feeds OSV and Dependabot, and a CVE can be requested directly from it.
Happy to do the work. If you enable reporting I will file a complete report through it — affected files and lines, CVSS vector, affected version range, and references — written so you can review and publish rather than having to write it up yourselves. I will also state plainly which parts I have verified by reading the released source and which I have not tested at runtime, so nothing is taken on trust.
If maintaining this repository is no longer a priority, that is a fair answer too — even a
SECURITY.mdnaming an email address, or archiving with a pointer to a successor, would be better for users than the current silence.No deadline from my side.
— Mohammad Adnan (CyStack)