Repository navigation
[Security]: Request for a private disclosure channel #300
Description
Product or interface
CLI - interactive TUI
Version
v0.5.1
Platform
Linux
OS version and architecture
Arch Linux x86_64 kernel: 7.2.6-arch2-1
Issue area
Other
Desktop log upload ID (optional)
No response
Steps to reproduce
I have reproduced a security issue affecting MiniMax Code CLI 0.5.1 on Linux.
In accordance with SECURITY.md, I am not including reproduction steps, technical details, source locations, logs, or proof-of-concept material in this public issue.
A complete report with a minimal reproduction and redacted evidence is ready. Could @hetaoBackend or another maintainer provide a private disclosure channel?
Expected and actual behavior
Expected: A private channel should be available for submitting the complete security report.
Actual: GitHub private vulnerability reporting is currently unavailable and SECURITY.md does not list a public security email, so the report cannot be submitted safely through the available public issue form.
Redacted error summary
A security-relevant CLI behavior has been reproduced consistently on MiniMax Code 0.5.1 under Linux. Full technical details are intentionally withheld from this public issue pending a private disclosure channel.Screenshots
No response
Before submitting
- I have searched existing issues.
- I have included my version and removed sensitive information.
Activity
hetaoBackend commentedon Sep 23, 2026
Thank you for handling this responsibly and following exactly the process described in
SECURITY.md— opening a public issue without vulnerability details to request a private channel is the right move while GitHub private vulnerability reporting is not yet enabled on this repository.Status:
When you do file the private report, the details requested in
SECURITY.md(affected version, OS and Node.js version, minimal reproduction, expected vs. actual permission boundaries, redacted evidence) will help us triage quickly.We appreciate the disclosure discipline — leaving this issue open as the tracking thread for the channel setup.
hetaoBackend commentedon Sep 25, 2026
Following up on the earlier channel-setup reply: you can submit your report directly by email now. Thank you for waiting and for withholding the details from this public issue.
Please send your full report privately to security.mcode@minimax.io, the MiniMax Code security contact. Include the affected version or source revision, OS, minimal synthetic reproduction, regression tests if available, and redacted evidence. Please reference this issue number in the email so we can connect the report to this request.
You do not need to wait for GitHub private vulnerability reporting to be enabled. Please continue to keep vulnerability details and proof-of-concept material out of public issues and community chats.
The README and security-reporting documentation update is in #360 (pending review). For general feedback or support unrelated to security, use MiniMaxCode@minimax.io.