Report suspected vulnerabilities privately through GitHub's vulnerability reporting form.

Include the affected library and Go versions, the potential impact, and a minimal reproduction or steps to reproduce. Remove real tokens, signing secrets, and other credentials from examples.

Keep vulnerability details out of public issues while the report is being investigated. Use GitHub issues for ordinary bugs and feature requests.