Hello everyone,
I am honestly a bit unsure how I am supposed to proceed from here, so I am asking here now.
On August 31, 2026, I sent a security report privately to security@syncthing.net and also submitted the same issue through a private GitHub Security Advisory.
Since I did not receive any response, I followed up again by email on September 8, 2026. I did not receive a reply to that either.
On September 12, 2026, I mentioned @calmh once in a GitHub issue and only asked him to check the emails. I am aware that the comment did not really belong in that issue, so I deleted it afterwards.
Shortly afterwards, I noticed that my GitHub account appears to have been blocked by Syncthing. Since then, when I try to continue using the private Security Advisory / PR workflow, I get messages such as:
Validation failed: User is blocked
and
You can't perform that action at this time.
I want to make it clear that I am not accusing anyone of blocking me because of that comment. I simply do not know why my account was blocked. But the timeline was exactly this: report on August 31, follow-up on September 8, tagging and then the block on September 12.
What also confuses me is that I have read receipts for several of my emails by now. So the messages were received and read. Despite that, I still have not received any substantive response.
In the meantime, I even prepared and tested a possible fix myself and pushed it to the private advisory fork. However, I cannot really continue there because of the block.
I am deliberately trying to keep this issue private, so I do not want to publish any technical details about the vulnerability here.
I would simply like to know how I am supposed to proceed now.
Is there another private contact for security-related issues? And can someone tell me why my GitHub account was blocked, or whether this block is permanent?
After several emails without a response and the additional block, the situation has honestly become quite frustrating for me.
Thank you.
