Do not publish credentials, private prompts, customer data, restricted corpora, exploit details, identity-sensitive review material, or private model outputs in an Issue or pull request.

For a security or privacy report that cannot be public, follow the private route documented at https://github.com/mmjbds/mianzhang.org/blob/main/.github/SECURITY.md.

ReflexBench is a public evaluation artifact. Reports should name the affected public version, scenario, scorer, file, or interface and provide the smallest safe reproduction. A benchmark weakness is not automatically a production vulnerability; state the demonstrated impact and the boundary of any inference.