Request

Please turn on Private vulnerability reporting in the repository's Security settings (Settings → Code security → Private vulnerability reporting → Enable).

Why

Today the repo exposes only two disclosure channels:

• a public GitHub Issue (wrong channel for anything sensitive), or
• the generic aws-security@amazon.com mailbox (works, but it is slow and reporters have no way to track status without the maintainers' help).

GitHub's private-vulnerability-reporting API returns 403 Repository does not have private vulnerability reporting enabled for this repo:

$ gh api repos/awslabs/gluonts/security-advisories/reports --method POST ...
{
  "message": "Repository does not have private vulnerability reporting enabled",
  "status": "403"
}

What changes for maintainers

Once enabled, a "Report a vulnerability" button appears in the Security tab, and outside reporters can open a private advisory draft. The draft is visible only to repo admins and the reporter; it doesn't become public until someone explicitly publishes it. This matches how the majority of the AWS Labs repositories that ship installable Python packages (e.g. aws-cdk, autogluon, a number of aws-samples/*) already handle disclosures.

Context

I'm asking because I want to send a deserialization-class advisory for this repo and I don't want to put exploitation details on aws-security@amazon.com without a way to coordinate on the patch PRs. Happy to route the report via the newly-enabled channel the moment it's on.