Do not report suspected vulnerabilities in a public issue.

First, follow the security policy in the affected repository. If it has no repository-specific policy and private vulnerability reporting is available, use Report a vulnerability in that repository's Security section. Otherwise, use a private contact channel already documented by that repository or organization.

Include the affected component and version, impact, reproduction steps, and any known mitigations. Do not send credentials, personal data, or unrelated secrets.

Supported versions and response expectations are defined by the affected repository; this organization-wide default does not establish a response or remediation timeline.