Report security-relevant findings privately to the maintainers before public disclosure. Do not commit secrets, access tokens, or sensitive production data.