Do not publish API keys, credentials, private endpoints, exploit details or sensitive logs in public issues or discussions.

Report a vulnerability through the Security tab of the affected repository using a private security advisory. Include affected versions, impact, reproduction steps and suggested containment when available.

Operational incidents without confidential exploit details use the central Incident form. Compromised API keys must be revoked immediately and replaced by server-generated keys. HTTP does not protect bearer credentials in transit; external deployments require a trusted network, VPN or TLS termination.

Supported versions are those explicitly listed as supported in the affected repository's current release documentation.