Do not open a public issue for a vulnerability that could expose user documents or private data.

For sensitive reports, use GitHub private vulnerability reporting from the repository's Security tab with:

• affected version
• impact
• reproduction details
• any workaround you found

For non-sensitive hardening issues, a normal GitHub issue is fine.