Do not publish exploitable details in a public issue. Contact the repository owner privately with:
- Affected component
- Reproduction steps
- Potential impact
- Suggested mitigation, if available
Do not include production credentials, personal data or proprietary information.