Security Policy Report vulnerabilities privately through GitHub Private Vulnerability Reporting. Do not disclose secrets or private data in public issues.