Do not publish suspected vulnerabilities in public issues. Report them privately to the repository owner through GitHub instead, with a clear reproduction and impact summary.

Do not include credentials, account tokens, or personal data in a report.