Report vulnerabilities privately through GitHub Private Vulnerability Reporting. Include the affected version, impact, and reproduction steps; do not open a public issue first.