Security Policy Report potential vulnerabilities privately to the maintainers. Do not disclose vulnerabilities publicly before a coordinated fix is available.