Do not file vulnerabilities in public issues. Report them privately to the repository maintainers with reproduction steps and affected versions. Never include secrets, cookies, or private hostnames in reports.