Report suspected vulnerabilities privately through the affected repository’s Security and quality → Advisories → Report a vulnerability page on GitHub. Include the affected version or commit, steps to reproduce the issue, and its security impact. Share a minimal reproduction without live credentials or other people’s data.

Keep vulnerability details out of public issues and pull requests while the report is being assessed. Coordinate public disclosure in the private report.

A repository’s own security policy takes precedence over this default. Check that policy for any supported-version commitments; this default does not set a support window or response deadline.