Report security issues privately to the repository owner. Do not include secrets, paid provider keys, generated voice files, or unlicensed media in issues or PRs.