Do not report vulnerabilities in a public issue, pull request, or discussion. Use GitHub's private security-advisory reporting for this repository. If private reporting is unavailable, contact the repository owner through the GitHub profile and include only the minimum information needed to establish a secure communication channel.

Include the affected file or workflow, impact, reproduction steps, and any proof of concept. Do not attach active credentials, private keys, production data, or exploit payloads that could harm third parties.

The maintainer should acknowledge a credible report within five business days, assess scope and severity, coordinate remediation privately, revoke or rotate exposed credentials immediately, and disclose a fix when users can act safely.

Use least-privilege credentials, protected branches, code review, signed commits where supported, and secret scanning/push protection. Secrets belong in an approved secret manager or GitHub Actions secrets, never in repository files or issue content.