Do not report vulnerabilities in public issues.

Use GitHub private vulnerability reporting to report a vulnerability confidentially to the repository maintainers. Include:

• Affected version
• Reproduction steps
• Impact
• Relevant sanitized logs
• Suggested mitigation, if known

Never include active credentials, tokens, cookies, customer data, or private environment details in a report.