Do not open public issues for suspected vulnerabilities.

Report security findings privately with:

• affected repository
• impact summary
• reproduction steps
• suggested mitigation, if known