Report vulnerabilities through GitHub private vulnerability reporting. Do not open public vulnerability issues. Security automation produces evidence but does not change a mathematical claim status.