Do not open public issues for vulnerabilities. Use GitHub private vulnerability reporting when available. Never attach credentials, session cookies, or private browser data.