Do not open public issues for vulnerabilities. Use GitHub private vulnerability reporting when available. Never put credentials or private runtime data in reports.