Report vulnerabilities privately through https://colomboai.com/security. Never submit private keys, live tokens, nonpublic evidence, or customer identifiers in an issue.