Unless a repository documents a longer support window, security fixes target its current default branch and latest published release. Prototypes may be changed or retired without backports; check the repository maturity declaration before relying on a project.

Do not include exploit details, credentials, personal data, or proof-of-concept payloads in a public issue.

1. Use GitHub's Report a vulnerability option on the affected repository's Security page when it is available.
2. If private reporting is unavailable, open a minimal issue titled Private security contact requested, mention @Nitin-Sagar-B, and include only the affected repository and a safe one-sentence impact category. A maintainer will establish a private channel before details are shared.

Include the affected version or commit, impact, reproduction conditions, and suggested mitigation once a private channel exists. The maintainer aims to acknowledge a complete report within five business days, but this is a best-effort open-source target rather than a service-level agreement.

Use test data and your own accounts. Do not access other users' data, degrade services, persist access, publish unpatched details, or use social engineering. Stop testing and report promptly if sensitive data is exposed.