Please do not put credentials or sensitive vulnerability details in public issues. If GitHub's private reporting option is available, use Security → Report a vulnerability. Otherwise open an issue asking the maintainer for a private reporting route without disclosing the vulnerability itself.

Include the affected commit or page, reproduction steps, expected impact and whether a saved layout or export is involved. Do not test against other people's accounts or data. Fixes go through review and the same local checks as other changes.