Report a suspected vulnerability through GitHub's private vulnerability reporting: open the repository's Security tab and choose "Report a vulnerability". No response time is promised.

Do not post credentials, personal backup files or exploit details in public issues. If private reporting is unavailable, hold back sensitive details until a private channel is available.

An exposed credential must be revoked or rotated with its provider. Removing it from the current tree does not remove it from Git history.