Use GitHub private security advisories for credential exposure, unsafe installers, path traversal, or destructive filesystem behavior. Do not publish secrets in issues.