Do not attach real snapshots containing secrets to a public issue. Provide a minimal synthetic reproducer and the nsdiff/compiler versions. Coordinate private reporting with the repository owner; no private contact address was present in the supplied project. See docs/security.md for the threat model and limitations.