Security Contact Request — Two Medium-Severity Findings (Responsible Disclosure)

[prasanna8585]

Hello Next.ID team,

I am a security researcher who has identified two medium-severity vulnerabilities in proof_server during a white-box audit. The findings affect the GitHub validator and the ActivityPub validator respectively.

I have been attempting to report these through BugRap since May 26, 2026 with no response. I am following responsible disclosure and do not want to publish details publicly.

Could you please:

• Enable private vulnerability reporting on this repo, OR
• Share a security contact email

My 90-day disclosure clock started May 26, 2026. Happy to share full technical details, PoC, and fix suggestions through a private channel.