Report vulnerabilities privately through GitHub's security advisory form, not in a public issue. Report issues in the embedded Tailscale engine, such as WireGuard, DERP or discovery, to Tailscale as its security policy describes.