Security: private coordinated disclosure ready (enable PVR or contact @macncrash)

[macncrash]

Coordination request (no technical details here)

I have a private coordinated vulnerability report for ultraworkers/claw-code affecting sandbox isolation reporting and permission-mode persistence (HIGH). Report includes full write-up and suggested patches.

Private vulnerability reporting appears disabled on this repository (GET .../private-vulnerability-reporting → enabled: false), so I cannot file a GHSA report via the API.

Please either

1. Enable private vulnerability reporting so I can submit the full package via GitHub Security Advisories, or
2. Contact @macncrash / macncrash@users.noreply.github.com and I will grant access to the private package repo or re-send the materials.

Private package (invite-only): https://github.com/macncrash/saudit-disclosure-claw-code-2026-07

I will not post exploit details, PoCs, or patches on this public issue.

Reporter: macncrash
AI-assisted analysis; findings human-verified. Local validation only.

Thank you.

[1716775457damn]

Thanks for the report @macncrash. Sandbox isolation and permission-mode persistence are critical areas — appreciate the responsible disclosure approach.

I don't have admin access to enable PVR on this repo, but this warrants immediate attention from maintainers. The private package link is noted for reference.

@ultraworkers maintainers — please enable private vulnerability reporting or reach out to @macncrash directly to receive the full write-up and patches.