Do not open a public issue for a suspected vulnerability. Contact the maintainer privately through the security contact listed on the repository profile and include a concise description, affected version or commit, reproduction steps, impact, and a safe way to follow up.

Do not include credentials, private customer data, or exploit payloads that are not necessary to reproduce the issue.

The template's hooks and scripts are safeguards, not a security warranty. Downstream projects must review their own stack, dependencies, integrations, data, deployment, and operational controls.