Report vulnerabilities privately through GitHub's private vulnerability reporting in the affected repository (Security tab, Report a vulnerability). Do not open public issues for them. We acknowledge reports within 7 days and agree on a disclosure date with the reporter. A repository's own SECURITY.md takes precedence over this default.