Report vulnerabilities privately through GitHub security advisories. Do not publish exploit details, credentials, private artifacts, or active environment data in issues. THEORY and PROTOTYPE projects are not production security boundaries.