Enable private vulnerability reporting? Potential high severity finding

[ria-labs-security]

Hi, we have a security finding in NetSparkle that we would like to report privately rather than in a public issue. The repository does not currently have GitHub's private vulnerability reporting enabled, and there is no SECURITY.md, so there is no non-public way to reach you.

Could you enable it? It is under Settings, Advanced Security, Private vulnerability reporting, and it costs nothing to turn on. Once it is on we will file the full report there, with the affected versions, the reproduction, our suggested patch and a proposed CVSS vector.

Happy to use email instead if you prefer, in which case just say where to send it.

To set expectations: the issue affects the default configuration, we'd rate this high severity, and we are not in a hurry. We will follow whatever disclosure timeline you want and will not publish anything before you are ready.

Thanks for maintaining this.

[Deadpikle]

Hi @ria-labs-security,

Appreciate you reaching out and not disclosing publicly. Thank you for that -- and the directions on turning on the private vuln reporting.

I've just turned it on. Please let me know if you have any issues submitting the report.

As far as timeline goes, I'll try to get a fix published asap (assuming it isn't 10000 hours of work), and I would imagine giving users a chance to upgrade before disclosure would be good...? TBH, never dealt with this sort of thing myself.

Anyway, looking forward to the report. Thanks again.

[ria-labs-security]

On timeline - yes, that instinct is exactly right. The usual approach is "coordinated disclosure": you take the time you need to ship a fix, give users a reasonable window to update, and only then does anything go public. There's no strict rule, but 60-90 days from
today is a common default if you want a target to aim for; we're equally fine going slower if the fix needs more time, or faster if you'd rather move quickly. Either way, we won't publish or mention this anywhere before you're ready.

Thanks again for taking this seriously.

[ria-labs-security]

Hello, Please find a submission https://github.com/NetSparkleUpdater/NetSparkle/security/advisories/GHSA-h6pm-4v8g-x9r8

…

________________________________ From: Deadpikle ***@***.***> Sent: Monday, September 7, 2026 8:13 AM To: NetSparkleUpdater/NetSparkle ***@***.***> Cc: Anton Naumovich ***@***.***>; Mention ***@***.***> Subject: Re: [NetSparkleUpdater/NetSparkle] Enable private vulnerability reporting? Potential high severity finding (Discussion #728) Hi @ria-labs-security<https://github.com/ria-labs-security>, Appreciate you reaching out and not disclosing publicly. Thank you for that -- and the directions on turning on the private vuln reporting. I've just turned it on. Please let me know if you have any issues submitting the report. As far as timeline goes, I'll try to get a fix published asap (assuming it isn't 10000 hours of work), and I would imagine giving users a chance to upgrade before disclosure would be good...? TBH, never dealt with this sort of thing myself. Anyway, looking forward to the report. Thanks again. — Reply to this email directly, view it on GitHub<#728?email_source=notifications&email_token=CNN5O3ZMJTB3NUENILAJNUL5NZGYBA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCOBTGI2TQMBQUZZGKYLTN5XKO3LFNZ2GS33OUVSXMZLOOSWGM33PORSXEX3DNRUWG2Y#discussioncomment-18325800>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/CNN5O3YHZBFKXB3PPX2CV535NZGYBAVCNFSNUABHKJSXA33TNF2G64TZHM2DMMRYGI2TOMR3IRUXGY3VONZWS33OHMYTANZWGQ3TSNNBOYBA>. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS<https://github.com/notifications/mobile/ios/CNN5O33GJWR34AKT53YYCB35NZGYBA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCOBTGI2TQMBQUZZGKYLTN5XKO3LFNZ2GS33OUVSXMZLOOSVGM33PORSXEX3JN5ZQ> and Android<https://github.com/notifications/mobile/android/CNN5O3354JHZ3IKZCGRXQCT5NZGYBA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCOBTGI2TQMBQUZZGKYLTN5XKO3LFNZ2GS33OUVSXMZLOOSXGM33PORSXEX3BNZSHE33JMQ>. Download it today! You are receiving this because you were mentioned.Message ID: ***@***.***>