Do not disclose a vulnerability, live credential, private endpoint, exploit payload against a third party, or production-sensitive configuration in a public issue, pull request, discussion, or artifact.

Use GitHub private vulnerability reporting when it is enabled for the affected repository. If it is not available, contact the repository maintainers through an already established private GitHub or project channel before publishing technical details.

A useful private report includes the affected repository and revision, the security boundary involved, a minimal reproduction that does not require real credentials, observed versus expected behaviour, and any known containment or mitigation.

Ordivon security research does not grant authority over third-party systems. Reproductions should use owned, synthetic, isolated, or explicitly authorized environments.