Security Policy Report vulnerabilities privately (add your contact here). Do not open public issues for sensitive reports. Keys and secrets must not be committed to the repository.