chore: route security reports to private advisories

[chethanuk]

Description

SECURITY.md is already strong — it uses GitHub Private Vulnerability Reporting (:16),
commits to concrete SLAs (3/7/14 days, :27-29), defines in/out scope, and documents
gh attestation verify (:53).

The issue chooser has no route to it. .github/ISSUE_TEMPLATE/config.yml offers only two
Discussions links, and blank_issues_enabled: false means a reporter cannot open a freeform
issue either. So someone holding a credential-leak bug arrives at the chooser, finds no security
option, and files on the public Bug Report form — which is exactly the outcome SECURITY.md
exists to prevent.

Having no security template is the correct pattern; routing to private reporting is right. Only
the route was missing.

 blank_issues_enabled: false
 contact_links:
+  - name: "🔒 Report a Security Vulnerability"
+    url: https://github.com/alibaba/open-code-review/security/advisories/new
+    about: Please report vulnerabilities privately, not as public issues. See SECURITY.md.
   - name: "💬 Questions & Help"

Ordering is the substance here, not a detail

With blank_issues_enabled: false the chooser is three rows. Someone holding a vulnerability
should not have to read past two Discussions links to find the private channel, so the security
row goes first. Peers all do this — pallets/flask, typeorm/typeorm, envoyproxy/envoy.

The URL is byte-identical to the one already in SECURITY.md:16, so there is no second source
of truth to drift.

Verification

Private vulnerability reporting is actually enabled on this repo, so the link resolves to a live
form rather than a 404:

$ gh api repos/alibaba/open-code-review/private-vulnerability-reporting
{"enabled":true}

I used that endpoint deliberately: curling the advisory URL anonymously returns a 302 to
/login, which proves nothing either way, and --jq .security_and_analysis comes back empty
because that field is admin-only.

Also checked:

• yaml.safe_load parses the file; contact_links[0]['name'] is the 🔒 row, 3 rows total
• The \U0001F512 escape form matches the file's existing style for the other two entries
• The URL matches SECURITY.md:16 exactly (one occurrence in each file)

Limitations

• I could not verify the rendered chooser upstream. I can render it on my fork, but that only
  proves the YAML chrome is valid — a fork does not necessarily have private vulnerability
  reporting enabled, so a fork render does not re-verify that the link works for this repo.
  Those are two separate claims and I'm keeping them separate: the API call above is the evidence
  for the second one.
• Nothing in CI validates .github/ISSUE_TEMPLATE/config.yml, so the test check on this PR
  does not exercise this change.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Refactoring (no functional changes)
• Documentation update
• CI / Build / Tooling

How Has This Been Tested?

• gh api repos/alibaba/open-code-review/private-vulnerability-reporting → {"enabled":true}
• yaml.safe_load parses; security row asserted to be contact_links[0]
• URL cross-checked against SECURITY.md:16

Checklist

• My code follows the project's coding style
• I have performed a self-review of my code
• I have added tests that prove my fix is effective — n/a, issue-chooser config
• New and existing unit tests pass locally with my changes
• I have updated the documentation accordingly (not applicable — SECURITY.md already
  documents the process; this only adds the missing route to it)
• I have signed the CLA

AI assistance: Claude Code helped research and verify this change. I reviewed the full diff
and take responsibility for it.

[coderabbitai]

Warning

Review limit reached

@chethanuk, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 3 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6b5be14d-9d6c-4b3e-898b-e3cfb2f467b0

📥 Commits

Reviewing files that changed from the base of the PR and between c60e886 and b8672b6.

📒 Files selected for processing (1)

• .github/ISSUE_TEMPLATE/config.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/security-contact-link

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request updates the GitHub issue configuration by adding a contact link for reporting security vulnerabilities privately. There are no review comments, and I have no feedback to provide on these changes.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[chethanuk]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.