From a690c8a33897b1a5550313fb292b7e74263dd4dd Mon Sep 17 00:00:00 2001
From: Daniel Bae <157205701+MrBeldum@users.noreply.github.com>
Date: Mon, 5 Oct 2026 12:37:54 -0700
Subject: [PATCH] docs: Offer private vulnerability reporting in the issue
 chooser

SECURITY.md directs reporters to the private advisory form, but
.github/ISSUE_TEMPLATE/config.yml only set blank_issues_enabled and had no
contact link for it. Add that link so the private route shows up in the
issue chooser. Private vulnerability reporting is already enabled for this
repository.
---
 .github/ISSUE_TEMPLATE/config.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index 3ba13e0c..9152784d 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -1 +1,12 @@
+# SECURITY.md asks that a vulnerability never be a public issue, so the private
+# route has to be visible in the issue chooser, next to the public templates.
+# Private vulnerability reporting is already enabled for this repository.
+#
+# blank_issues_enabled stays false (existing behaviour): reporters still pick a
+# template or the private security route below.
+
 blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/Quantco/tabmat/security/advisories/new
+    about: Do not open a public issue. Report it privately here. See SECURITY.md.