Do not open a public issue for a suspected vulnerability or attach private media, credentials, exploit details, or personal data.

Public release is blocked until a private reporting contact and response policy are approved. Until then, report security concerns directly to the repository owner through a private channel. Public hardening issues may be created only after disclosure is safe.