Report suspected credential exposure or vulnerabilities privately to the repository owner instead of opening a public issue. Authentication keys must be referenced through environment variables, stored outside the repository, and restricted to the owning user (0600 on Unix-like systems).