Do not open a public issue for a suspected data exposure, leaked credential, cross-user access, viewer-token weakness, or alert-delivery abuse path. Contact the repository owner privately with a concise reproduction and affected component.

Do not include contact destinations, viewer tokens, JWTs, precise coordinates, phrases, recordings, or production secrets in reports. Rotate exposed secrets immediately and invalidate affected viewer tokens before wider investigation.