Use GitHub private vulnerability reporting to report a security issue. Include the affected rule, a minimal workflow that reproduces the behavior, impact, and suggested remediation when available.

Do not include production workflows, credentials, private repository names, customer data, or internal system details. Replace them with synthetic values.

Security fixes are applied to the latest version on the default branch.