Report vulnerabilities through Security > Report a vulnerability in the affected repository. Do not include vulnerability details in a public issue.

Include the affected version or commit, reproduction steps, impact and a suggested mitigation. If private reporting is unavailable, open an issue that requests a private contact channel.

Until versioned releases exist, only the latest default branch is supported.