Do not report vulnerabilities containing personal data in public issues. Before launch, the repository owner must configure a private security contact and GitHub private vulnerability reporting. Reports should include affected version, reproduction steps, impact, and suggested mitigation. v0.1 is alpha software and must not autonomously make high-stakes decisions.