Do not report suspected vulnerabilities in a public issue. Use GitHub private vulnerability reporting.
Include affected versions, impact, reproduction details, and known mitigations. Do not publish exploit details until coordinated disclosure is complete.