Do not open a public issue for a suspected vulnerability or exposed secret. Use GitHub's private vulnerability reporting for the affected repository when available. Otherwise contact the repository owner privately through the channel listed in that repository.

Include the affected repository and revision, impact, reproduction steps, and any safe mitigation already attempted. Never include live credentials.