Report vulnerabilities privately to the organization maintainers. Do not open public issues containing exploit details, credentials, regulated data or personal information. Research examples must use synthetic data.