Do not disclose vulnerabilities in public issues.

Use the affected repository's private vulnerability reporting feature. Include the affected version, reproduction steps, impact, and a suggested mitigation when possible. Do not include live secrets or destructive payloads.