Report suspected vulnerabilities privately to the maintainers. Do not open public issues containing exploit details, credentials, real personal data, regulated records, or operational instructions.