# Security

Report vulnerabilities privately through the hosting instance. Never include credentials, tokens, private URLs, or real user data in issues or fixtures.