Report security issues privately to the repository owner. Do not commit credentials, private keys or sensitive client data. Rotate and purge any secret accidentally committed.