For a private GitHub repository, report vulnerabilities through the repository's Security tab using a private vulnerability report. Do not put credentials, access tokens, private dataset URLs, or sensitive images in a public issue.

Include the affected version, reproduction steps, impact, and any suggested mitigation. Rotate any credential that was accidentally committed before rewriting repository history.