Report vulnerabilities through GitHub private vulnerability reporting. Do not include API keys, private transcripts, or unredacted diagnostic logs in a public issue.