Report a vulnerability in VibeLang privately through GitHub's private vulnerability reporting. Don't open a public issue or pull request for it.

Include the affected package and version, what an attacker could do, and the smallest reproduction you can share. A maintainer replies in the advisory, coordinates the fix, and publishes the advisory with the fixed release.

VibeLang is v0. Fixes ship in a new version, so upgrade to the latest release to get them.