Studio server: writes/deletes proceed after a failed backup (data loss); private vulnerability reporting is disabled despite SECURITY.md #3957

1. Studio server: write and delete routes proceed after a failed backup (silent data loss)

snapshotBeforeWrite in packages/studio-server/src/helpers/backupJournal.ts returns { backupPath: null, error } when the backup cannot be written. Some callers handle that correctly (the batch write and the insertion route return 500; applyEdits throws), but at least two write paths only log and continue, at main commit e2d60cf (2026-09-15):

• packages/studio-server/src/routes/files.ts lines 460–461 (writeMutationResult): if (backup.error) console.warn(...) and the file is written anyway.
• packages/studio-server/src/routes/files.ts lines 2381–2383 (the file PUT): if (backup.error) console.warn(...) and then ftruncateSync + writeSync overwrite the file.
• The delete route in the published 0.8.36 bundle showed the same pattern before rmSync / unlinkSync.

Impact: when the backup journal cannot be written (disk full, permissions, a damaged .hyperframes/backup tree), Studio silently overwrites or deletes the user's real file with no undo while reporting success to the client.

Suggested fix: treat backup.error as fatal on every write and delete path (return 500 with the error, as the batch and insertion routes already do), or make the override explicit with an opt-in flag in the request.

Environment: macOS (Apple silicon), Node 26, hyperframes 0.8.36 and 0.8.40; verified against the main source at e2d60cf.

2. Private vulnerability reporting is disabled, but SECURITY.md points to it

SECURITY.md asks reporters not to open public issues for vulnerabilities and to use a GitHub Security Advisory instead. Creating one returns 403: Repository does not have private vulnerability reporting enabled.

I have a separate, security-relevant finding in two Studio-server routes (a request-path handling issue) that I will only send through a private channel. Please enable private vulnerability reporting on this repository, or name a security contact, and I will send the full report with reproduction steps and a suggested fix the same day.