Do not disclose a suspected vulnerability, credentials or personal data in a public issue or pull request.

Use the affected repository’s private vulnerability reporting entry in its Security section when available. If it is unavailable, withhold sensitive details until a private channel has been established with the maintainer. This document does not promise an alternative contact address or a response deadline.

A report should identify the affected repository and revision, describe the impact and provide a minimal reproduction using synthetic data. Remove secrets and unrelated personal information from attachments and logs.

Security controls and supported capabilities are stated by each repository. A documented future scope is not a deployed service, and this portfolio overview does not certify the security of an unqualified implementation.