Report suspected vulnerabilities privately through the repository's GitHub Security Advisories. Include the package version and a minimal reproduction, without credentials or private application data. Do not post vulnerability details in public issues.