Never commit real credentials, private endpoints, account identifiers, or customer material. Use the hosting platform's private security-reporting mechanism to report leaked credentials or inadvertently released private material. If private reporting is unavailable, open a minimal issue requesting a secure contact channel without including the sensitive value.

Task ambiguity, scoring disagreements, and benchmark-quality concerns are not security vulnerabilities and should use the ordinary issue process.