Request for private security reporting channel

[davidtennyson79]

Product or interface

Desktop app

Version

0.5.4

Platform

Windows

OS version and architecture

Windows 11 x64

Issue area

Other

Desktop log upload ID (optional)

No response

Steps to reproduce

I found multiple reproducible security issues in the current MiniMax Code source preview while performing external security testing.

I have minimal synthetic reproductions, regression tests, and redacted evidence prepared, but I do not want to disclose vulnerability details in a public issue.

Please provide the appropriate private reporting channel so I can share the findings responsibly.

Expected and actual behavior

Expected: A private security reporting channel should be available for disclosure of vulnerability details.

Actual: The repository security guidance directs reporters to request a private channel when private vulnerability reporting is unavailable. I am opening this issue only to request that channel and am intentionally withholding vulnerability details from the public issue.

Redacted error summary

Multiple reproducible security findings are ready for private disclosure. No credentials, real user data, destructive actions, or third-party infrastructure were used during testing.

Screenshots

No response

Before submitting

• I have searched existing issues.
• I have included my version and removed sensitive information.

[hetaoBackend]

Thank you for preparing synthetic reproductions and redacted evidence, and for keeping the findings private.

Please send your full report privately to security.mcode@minimax.io, the MiniMax Code security contact. Include the affected version or source revision, OS, minimal synthetic reproduction, regression tests if available, and redacted evidence. Please reference this issue number in the email so we can connect the report to this request.

You do not need to wait for GitHub private vulnerability reporting to be enabled. Please continue to keep vulnerability details and proof-of-concept material out of public issues and community chats.

The README and security-reporting documentation update is in #360 (pending review). For general feedback or support unrelated to security, use MiniMaxCode@minimax.io.