We prefer security vulnerabilities reported as private issues in GitHub:

Use this section to tell people about which versions of your project are currently being supported with security updates.

Please report suspected security vulnerabilities using GitHub's private vulnerability reporting form. Do not disclose the vulnerability in a public issue, pull request, or discussion.

Please include, where available:

• A description of the vulnerability and its security impact.
• The affected Heimdal version or commit, platform, and relevant configuration.
• Steps, test cases, or a proof of concept that reproduce the issue.
• Any suggested fix or mitigation.
• Your preferred credit and coordinated-disclosure timeline.

Use the private report for subsequent discussion and for sharing sensitive artifacts. The Heimdal security team will review the report, ask for any additional information needed to reproduce it, and coordinate a fix and disclosure with the reporter and affected downstream projects.