Report vulnerabilities privately — never in a public issue.

Preferred channel: private vulnerability reporting on the affected repository. On oxidean/oxidean, go to Security → Advisories → Report a vulnerability and describe the problem.

If that channel isn't available for the repo in question, email contact@oxidean.dev.

We review every report and will respond as soon as we can. Oxidean is pre-1.0: fixes land on main and ship with the next release; we don't backport to older tags yet.