Report privately — never in a public issue. See unierp-platform/SECURITY.md.

A public issue describing a cross-tenant read tells every operator running UniERP and every attacker looking at it at the same time.