Report vulnerabilities through GitHub private vulnerability reporting. Do not open public vulnerability issues. Security findings and CI runs are evidence; only admitted MATHCERT records determine mathematical disposition.