Discussions are public. Do not post vulnerabilities, exploit details, credentials, or private data in them.

Report them privately in that package's own repository, through its Security tab. For example, use the php-diff security page for pharaonic/php-diff.

Use GitHub's private vulnerability reporting for vulnerabilities in this repository's workflows or for malicious links in its files: Report a vulnerability.

If you posted a secret by mistake, revoke or rotate it first, because deleting the post does not make it safe again. Then edit or delete your post. If you see someone else's secret or a malicious link, use Report content on the post rather than replying to it.