Use GitHub private vulnerability reporting if it is enabled for the affected repository.

If private vulnerability reporting is not available, open a minimal issue without exploit details. Maintainers will coordinate privately before public disclosure.