Do not open a public issue or discussion for a suspected vulnerability.

Open the affected repository on GitHub, select Security, then Advisories, then Report a vulnerability. This creates a private report owned by the repository whose code is affected.

Include the affected version or commit, impact, reproduction conditions, and any proposed mitigation. Avoid including credentials, personal data, private repository content, or unrelated machine-local paths.

If the repository does not show Report a vulnerability, do not substitute another repository. Contact an organization owner and identify only the affected repository until private reporting is restored.