[CRITICAL]: SECURITY.md asks for Private Vulnerability Reporting, but there is no "Report a vulnerability" button

[uziii2208]

What happened?

Bug Description

SECURITY.md tells researchers not to file public GitHub issues and to use GitHub Private Vulnerability Reporting:

Go to the Security tab of the repository, click on "Advisories", and select "Report a vulnerability".

That button is not available to me as an external reporter.

On the Security Overview page, all three features show as Enabled:

• Security policy • Enabled
• Security advisories • Enabled
• Private vulnerability reporting • Enabled

Enabled in Overview is not the same as a working intake path. I can open the policy and the advisories list, but I never get a "Report a vulnerability" action. The Advisories page is empty ("There aren't any published security advisories") with no report CTA.

I have verified security findings that I am withholding from this public issue on purpose, per your own policy. I cannot send them until a private report button (or another private inbox) actually works for non-maintainers.

Please expose "Report a vulnerability" for logged-in outside contributors, or reply here with a private intake (security email or a handle I can contact). Do not ask me to paste the findings on this thread.

Steps to reproduce

1. Open https://github.com/pascalorg/editor (logged in to GitHub, not a maintainer).
2. Click the Security tab.
3. Open Security Overview and confirm all three rows are Enabled:
   • Security policy • Enabled → "View security policy"
   • Security advisories • Enabled → "View security advisories"
   • Private vulnerability reporting • Enabled → "See reported vulnerabilities"
4. Click "View security policy".
   Result: SECURITY.md only. It says to use Private Vulnerability Reporting and not to open a public issue. There is no "Report a vulnerability" button on this page.
5. Go back and click "View security advisories".
   Result: empty list ("There aren't any published security advisories"). There is no "Report a vulnerability" button.
6. Click "See reported vulnerabilities" (if visible).
   Result: no reporter intake form / no way for an outside user to file a private advisory.
7. Try the documented deep link:
   https://github.com/pascalorg/editor/security/advisories/new
   Result: no usable private report form (button missing or "You can’t perform that action at this time").

Expected behavior

When Private vulnerability reporting is Enabled, a logged-in user who is not a maintainer should see a "Report a vulnerability" button on the Security / Advisories page, as SECURITY.md describes.

Clicking it should open GitHub's private advisory form (title + description at minimum) so findings can be sent only to maintainers.

Actual Behavior

• Overview shows Security policy, Security advisories, and Private vulnerability reporting all Enabled.
• SECURITY.md forbids public issues and points at a button that is not visible.
• Policy page, Advisories page, and /security/advisories/new do not present a working "Report a vulnerability" CTA to an external reporter.
• The only remaining GitHub channel is a public issue, which is what this ticket is, and which your policy asks us not to use for vulnerability details.

Deployment Method

Other

Editor Version

v0.9.1 / main (repository Security settings and SECURITY.md on the default branch)

Affected Area

Classroom generation

Browser

Chrome (latest), logged in to GitHub

Operating System

Not applicable

Relevant Logs

N/A — GitHub UI / repository security-settings issue, not an application runtime error.

Pages checked:
- https://github.com/pascalorg/editor/security
- https://github.com/pascalorg/editor/security/advisories
- https://github.com/pascalorg/editor/security/advisories/new
- SECURITY.md on main, section "Reporting a Vulnerability"

Browser & OS

Chrome (latest), logged in to GitHub

Screenshots or screen recordings

Attached:

1. Security policy page (SECURITY.md) — instructions to use Private Vulnerability Reporting, no report button.

2. Security Overview - all three features Enabled (policy, advisories, private vulnerability reporting), still no "Report a vulnerability" CTA.

Please do not request vulnerability details, PoCs, or affected paths on this public issue.

Additional context

I have multiple verified reports ready, including High/Critical issues. I will file them the same day the private button works, or the same day a maintainer shares another private inbox.

Please do not ask me to paste findings, PoCs, or file paths on this thread.

Maintainer-side check (repo admin):

1. Settings → Advanced Security (or Settings → Code security and analysis)
2. Private vulnerability reporting = Enable
3. Confirm that a logged-out / non-collaborator test account sees "Report a vulnerability" on
   https://github.com/pascalorg/editor/security/advisories
   Docs: https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/configure-for-a-repository

If the feature is on but restricted to org members, please say so here and give an external intake path.

Thank you for maintaining Editor. I want to report this the way SECURITY.md asks — the button just is not there from my side.