Report vulnerabilities privately through GitHub Security. Do not disclose client secrets, authorization codes, access tokens, private user data, or callback traces in public issues.

The current main commit and latest tagged release are supported. Never commit .env files, OAuth credentials, access tokens, production state databases, or captured callback URLs.