If you discover a security vulnerability, contact the repository owner privately with a clear report and reproduction steps. Do not post exploit details in public issues.