Do not open public issues for vulnerabilities. Use GitHub's Report a vulnerability private advisory for this repository. Include affected version, impact, reproduction, and mitigations, but never production credentials or personal data. Maintainers acknowledge reports on a best-effort basis; Community Preview has no response-time SLA. Rotate any credential disclosed accidentally and remove it from Git history.