Report suspected vulnerabilities privately through GitHub's security advisory workflow. Do not place secrets, personal HR data, customer data, or unpatched vulnerability details in public issues or pull requests.