Please do not report suspected exploitable vulnerabilities, passwords, private tokens, personal information, or detailed exploitation steps in a public GitHub issue.

Use the site's contact page and identify the message as a security report. Provide the affected URL or component, potential impact, and a minimal, safe reproduction description.

If a particular repository supports GitHub private vulnerability reporting, you may use that channel as well.

Do not disrupt services, access data belonging to others, or conduct intrusive production testing without permission. We do not promise a public bug-bounty program or a particular response deadline.