Thank you for writing. I moved the public list to BCC (for one message of closure) and CCed the private list, which has an appropriately small membership in case if there is some future need to exchange in more detail: I don't see it so far. Helping bridge the communication gap may be the best we can offer, in Savannah terms.
I have also BBCed an email we have for the maintainer; maybe that's a better one. On Fri, Oct 2, 2026 at 11:16 AM B.B Shalitha M Gamage <[email protected]> wrote: > > Hello Savannah Support Team, > > I am a security researcher currently trying to coordinate a private > security disclosure concerning the GNU m17n-lib project hosted on Savannah. > > I have privately reported several vulnerabilities in m17n-lib to the > upstream maintainer, Kenichi Handa, and have also notified the Debian and > Red Hat security teams. > > I am currently having difficulty reaching the appropriate m17n > development/security communication channel, and I would like to make sure > that the report reaches the appropriate project maintainers. > > Could you please advise me on the correct Savannah contact, mailing list, > or project tracker through which a private security report concerning the > m17n project should be submitted? > > I am only trying to ensure that the security report reaches the > appropriate m17n project maintainers through the correct channel. > > I can provide the vulnerability report and PoC if required, but I would > prefer to send the technical details only to the appropriate > security/maintainer contact rather than a general-purpose mailing list. > > Thank you for your assistance. > > Best regards, > > Shalitha Madhuwantha > Security Researcher > [email protected] > LinkedIn: linkedin.com/in/shalitha-madhuwantha > About: about.me/shalithamadhuwantha >
