Use GitHub private vulnerability reporting. Do not disclose exploit details or sensitive data in public issues or pull requests.

Include the affected commit or version, expected impact and minimal reproduction steps. Use synthetic examples and redact screenshots and logs. If your own credential was exposed, revoke or rotate it. Report credentials you do not control promptly and privately; do not use or attempt to revoke them.

Check the current default branch, main, and, if using a release, the latest release published by this repository before reporting an issue. Fixes, when provided, target the default branch. Older versions do not receive separate backports. Reports are handled on a best-effort basis without guaranteed response or remediation times.

Use synthetic application inventories and temporary test directories. Never attach your real installed-application inventory or unredacted user paths.