Report vulnerabilities privately through GitHub security advisories. Do not publish credentials, exploit details or private infrastructure data in public issues. No supported product release exists yet.