Report vulnerabilities privately through GitHub private vulnerability reporting. Do not post credentials, API keys, private addresses, calendar events, or spreadsheet contents in public issues. Use synthetic examples and describe the impact and reproduction steps. Response times are not guaranteed.