Do not use a public issue for security-sensitive reports, and never publish credentials, private keys, production host details or customer data.

The complete security model, supported reporting process and project security boundaries are documented in docs/SECURITY.md.

For responsible disclosure, use the repository's private security-reporting channel when available. If that is unavailable, contact the maintainers without including secrets in a public issue.