Do not disclose suspected vulnerabilities, credentials, or private data in a public issue.

Use the repository's Security tab and private vulnerability reporting when that option is available. If it is unavailable, open a minimal issue asking the repository owner for a private contact channel without including sensitive details.

Include affected versions, reproduction conditions, impact, and a suggested fix when possible. Reports will be assessed before public disclosure.

Unless a repository states otherwise, only its default branch is considered actively maintained.