Please do not disclose vulnerabilities publicly.
Report privately to:
Include:
- affected repository and commit/version
- reproduction steps
- impact summary
- any mitigation notes
- initial triage acknowledgment: within 3 business days
- critical issues are prioritized first
Coordinated disclosure is preferred after remediation is available.