On an arbitrary gitea instance I opened the form to report a new bug. There was no way to tag the bug as a security bug, which should hide the bug from public view until project maintainers decide to release it.

And ironically, gitea has a dog food problem. That’s right, they use MS Github themselves. Hence why this is reported here. Codeberg has (or had at one point) a repo where gitea bugs could be reported, but Codeberg deleted my account and now there are some hurdles for new registrations that caused me issues. So here we are. IIRC gitea also has a demo instance where bugs can be reported. If I get around to it I might track that down and report this bug there.