# Security

Report vulnerabilities privately through the hosting instance. Never include credentials, tokens, or real user data in issues or fixtures.