Report suspected vulnerabilities privately to the repository owner. Do not include credentials, private keys, webhook signatures, tokens, private repository paths, or customer data in issues or pull requests.

Steward never executes pull-request code with central credentials. Runtime, Copilot, release, and deployment secrets remain in their dedicated central environments and are not copied to consumer repositories.