Report vulnerabilities privately to the Toolkit security owner before public disclosure. Do not include secrets, customer data, or private environment values in issues.