Do not open a public issue for a possible vulnerability. Use the target repository's private vulnerability reporting entry. If sensitive information is posted publicly, stop public debugging, preserve only the minimum reference, and wait for a human security owner.

Automated tools and agents may flag a possible security signal but may not classify it as safe, decide disclosure, contact affected parties, or promise a fix date.