Report vulnerabilities through GitHub private vulnerability reporting. Do not open public vulnerability issues. Operational work packages do not certify mathematics.