Requesting Private Vulnerability Reporting be enabled (security report ready)

[SyedAnas01]

Hi cloudinary maintainers,

I found a security vulnerability in this repository (same bug class already reported, open and unmerged, on two sibling MCP server repos: cloudinary/account-provisioning-mcp#1 and cloudinary/analysis-mcp#1) and would like to report it responsibly. Could you enable GitHub's Private Vulnerability Reporting for this repo so I can file a private advisory? It's already enabled on cloudinary/asset-management-mcp, which received the same request.

If you'd prefer a different channel, a security contact email works too — I'm happy to hold the report under a standard 90-day disclosure window either way.

Thanks,
Syed Anas Mohiuddin

[PixelCook]

Hi,

We welcome security researchers and accept responsible disclosures.

To better serve the researchers' community, Cloudinary is running a managed bug bounty program on Bugcrowd.
Please open a Bugcrowd account if you don't already have one, and join our program at https://bugcrowd.com/cloudinary

The program contains all the information you'll need to submit a report, including:

Information about which features and endpoints are considered 'in scope' or 'out of scope' for the programDetails of the rewards we offerThe full terms and conditions of our program

You should also be aware that third-party tools and services are considered out of the scope of our program, so if you're researching third-party tools that we use, such as Intercom or Zendesk you should use their programs, which you can find here:
https://bugcrowd.com/intercom
https://hackerone.com/zendesk

Best regards,
Zachary