Report vulnerabilities privately to the repository owner using GitHub private reporting when available. Do not attach real credentials, full auth/character dumps or player profiles. Keep compatibility protocol modes scoped to their current local/loopback use. Public/WAN hosting is outside the validated deployment model.