Security contact request (private vulnerability disclosure)

Hi @xlab,

Thanks again for responding to the licensing question.

While integrating vorbis-go into ddsonic, we identified a potential security vulnerability related to handling malformed Vorbis data.

We've prepared a technical report with reproduction evidence and suggested mitigations. We'd like to share it privately so you have an opportunity to investigate before any technical details are made public.

Would you consider enabling GitHub's private vulnerability reporting feature for this repository, or providing a preferred private security contact?

Thanks for your time and for maintaining the project!