We found a critical security issue affecting EclipseLink and we would like to report it privately. Is there a private channel to report security issues? Otherwise, can a lead developer get in contact with me using the email linked to this account?
hm, I (or all committers) can see it and was expecting it is visible to everyone, which is apparently not true Can you send more details directly to me instead, please? You're email is not visible in your profile (that's how it is by default...)