Found a bypass? Open an issue if it is a command-line trick (those are expected, see KNOWN-BYPASSES.md, and a public test helps everyone). Use GitHub's private vulnerability reporting (Security tab) if the guard itself can be made to run code, leak data, or crash in a way that disables it.