Do not report vulnerabilities in a public issue. Use GitHub's private security advisory form with affected versions, reproduction steps, impact, and any suggested mitigation. No response-time or remediation guarantee is implied.