Report vulnerabilities through the Security tab of the affected repository using a private vulnerability report when available. Do not open a public issue for an undisclosed vulnerability.

Include the affected component and version or commit, the trust boundary that is crossed, reproduction details, and any known mitigations. Never include production credentials, private signing material, or personal data.

Repository-specific security policies take precedence when present.