Do not report vulnerabilities in public issues.

Send a private report to the repository owner with the affected component, reproduction steps, impact, and any suggested mitigation. Do not include active credentials, customer media, payment records, or personal information in the report.

Provider keys must remain server-side and must be rotated immediately if they are exposed. Staging and production use separate credentials, databases, buckets, Redis instances, authentication secrets, and deployment environments.