Report vulnerabilities privately through GitHub's security-advisory interface rather than a public issue.

The catalog must not contain credentials, private endpoints, local user paths, application bundles, configuration backups, or logs with user content. Each linked harness has its own operational security guidance.