Report suspected vulnerabilities privately to the owner. Do not publish exploit code or credentials in issues. The scanner is not a malware guarantee.