Do not file public issues for credential disclosure, authentication bypass, route exposure, or SSRF vulnerabilities. Report privately to the project maintainers with reproduction steps and affected version.