Report vulnerabilities privately through GitHub Private Vulnerability Reporting. Include plugin, Library, WordPress and PHP versions, reproduction steps and impact. Do not include credentials or personal content. Coordinate fixes and disclosure before publishing details.
Ordinary bugs and questions belong in Issues or Discussions. Security fixes receive prioritized patch releases; no fixed response time is promised.