Use GitHub's private vulnerability reporting for dependency, package supply chain, unsafe input handling or native-boundary issues. Do not publish secrets, private logs or device information in issues.