Report vulnerabilities privately through GitHub. Include the affected version, reproduction, and impact. Do not file a public issue. Use public issues for other bugs.