Report vulnerabilities privately through the repository's Security → Advisories → Report a vulnerability option when available. If private reporting is unavailable, contact the repository owner through a private channel you already use; do not disclose exploit details in a public issue. No dedicated security email or response-time guarantee is published here.

Include the affected commit, impact, minimal reproduction and sanitised evidence. Do not send live secrets, owner capabilities, payment references, private documents, recordings or customer records. Test with disposable local fixtures and avoid accessing other people's data.

Revoke exposed credentials through the relevant provider. Removing a credential from a commit does not revoke it. Dependency and source checks are recorded in repository verification; they are not a guarantee that every vulnerability has been found.