Report suspected vulnerabilities privately to the repository owner using GitHub private vulnerability reporting when available. If unavailable, contact the owner through the contact details on their GitHub profile. Do not put credentials or exploitable details in a public issue.

See the security controls guide for CI checks, vulnerability thresholds, exceptions, repository settings, and credential rotation.