Do not open a public issue for an undisclosed vulnerability. Open the affected repository's Security tab and use Report a vulnerability. If that flow is unavailable, contact a repository maintainer privately through their published contact channel.

Include the affected repository and revision, impact, platform, and a minimal reproducer when practical. Maintainers aim to acknowledge reports within seven days and provide a triage decision within fourteen days.

Supported versions and deployment boundaries are documented in each repository. Unless a project says otherwise, only the current default branch and latest release receive security fixes.

Never include real credentials, personal data, or third-party confidential material in a report.