Report vulnerabilities privately through GitHub's private reporting channel.

Do not open a public issue for a vulnerability. Never attach transcripts, reductions, findings, or other confidential data to a report. Provide a synthetic minimal reproduction where possible.