Report vulnerabilities privately through GitHub's security advisory interface. Do not include sensitive data in public issues. Supported prerelease versions receive fixes on a best-effort basis.