Do not open a public issue for an undisclosed vulnerability or exposed secret. Use GitHub's private vulnerability reporting feature when available. If it is unavailable, contact the repository owner privately through the account's published contact channel.

Include the affected component, reproducible impact, minimal proof, and a suggested mitigation. Do not access data that is not yours or test outside authorized scope.