TL;DR: Do not post API keys, captured images, logs, databases, or private configuration in a public issue.

Use the repository's private vulnerability-reporting feature in the Security tab. If it is unavailable, open a public issue requesting a private contact route without sharing the vulnerability details.

Stack handles camera frames and can optionally use an API key. Include the affected version and a minimal synthetic reproduction where possible. Do not attach real desk images, ~/.posture_monitor contents, or Keychain output.