Do not publish exploitable vulnerabilities, secrets, or personal data in public issues. Report specification flaws or implementation vulnerabilities through the repository's private vulnerability reporting feature when available, or through ColomboAI's published security contact. Include affected version, reproduction steps, impact, and safe disclosure timing. The draft editors will acknowledge, triage, coordinate remediation, and publish a change note when appropriate. This document does not claim that private reporting is already configured on any GitHub repository.