Do not put undisclosed vulnerability details in a public Issue. Use GitHub private vulnerability reporting to contact the maintainer, and give time to triage before any disclosure. The maintainer will triage severity and exposure, remediate, verify the fix, and coordinate release and disclosure. Do not disclose until a coordinated release exists.

For authentication, credential setup, transport, and trusted-workload boundaries, see security configuration.