Unable to report architectural bug/vulnerability (Security Advisory link returns 404)

[Ahmedali1010]

Description:
Hello team,
I have identified an architectural flaw regarding SSE (Server-Sent Events) domain event broadcasting and React state hydration/persistence in the starter kit. I have already developed a complete fix for it.
I attempted to follow your ⁠SECURITY.md⁠ guidelines by reporting it privately via the provided link (⁠/security/advisories/new⁠), but the page returns a 404 Not Found error. It appears the "Private vulnerability reporting" feature might not be enabled in this repository's settings.
Since I am strictly following your policy to not disclose this publicly, please let me know the preferred method to securely submit the details and the corresponding PR.
Thank you.

[Ahmedali1010]

Hello team,
I have identified an architectural flaw regarding SSE (Server-Sent Events) domain event broadcasting and React state hydration/persistence in the starter kit. I have already developed a complete fix for it.
I attempted to follow your ⁠SECURITY.md⁠ guidelines by reporting it privately via the provided link (⁠/security/advisories/new⁠), but the page returns a 404 Not Found error. It appears the "Private vulnerability reporting" feature might not be enabled in this repository's settings.
Since I am strictly following your policy to not disclose this publicly, please let me know the preferred method to securely submit the details and the corresponding PR.
Thank you.

[iammukeshm]

Thanks for flagging this, and sorry for the friction — the 404 was on us. Private vulnerability reporting wasn't enabled on the repo, so the /security/advisories/new link in SECURITY.md was dead for outside reporters. I've just enabled it, so that link works now.

On the finding itself: from your description — SSE domain event broadcasting plus React state hydration/persistence — this sounds like a functional/architectural gap rather than a security vulnerability. For context, the SSE layer currently has no server-side event producers wired at all (nothing calls SseConnectionManager.Broadcast/TrySend), so the dashboard feed only emits heartbeats today. If that's what you ran into, it's an incomplete feature rather than an exploitable flaw.

So: if there's no attacker-reachable impact, please open a regular issue describing the behaviour and send the PR against main — that's faster for both of us and lets others benefit from the discussion. If you do believe it's exploitable (e.g. cross-tenant event leakage, auth bypass on the stream token), use the advisory link and we'll handle it privately under the timelines in SECURITY.md.

Either way, the fix is welcome — thanks for taking the time to follow the policy properly.

[Ahmedali1010]

Thank you for the clarification. I initially misinterpreted the SECURITY.md policy, assuming that all findings or bugs, regardless of their nature, were strictly prohibited from public disclosure and required private reporting.

Since this specific finding is an architectural gap rather than an exploitable security vulnerability, I have followed your recommendation:

Opened a Public Issue: I have documented the behavior and the functional gap in a new public issue.

Submitted a PR: I have opened a Pull Request against the main branch containing the proposed fix.

I appreciate your time, guidance, and prompt response.