Private security disclosure route?

[dodge1218]

Hi, I found a security issue affecting this repo and do not want to post exploit details publicly.

Could you provide a preferred private security contact, or enable GitHub private vulnerability reporting for this repository?

High-level, non-sensitive summary only: this concerns default Docker HTTP deployment behavior around Argo CD credential exposure/control. I have not posted exploit details here.