Please do not report suspected security vulnerabilities in public GitHub issues or discussions, and do not post exploit details, credentials, private data, or non-public logs publicly.

Report suspected vulnerabilities privately through the Meta Bug Bounty program. Include the technical details there rather than in a public thread.

If sensitive information or a credential has already been posted publicly:

1. edit or delete the public text to reduce further exposure;
2. revoke or rotate the exposed credential immediately; and
3. submit the vulnerability and relevant details through the private reporting channel.

Deleting public text is not sufficient on its own because copies may already exist in notifications, mirrors, or caches.

For ordinary SDK, protocol, or documentation bugs that do not present a security or privacy risk, use the repository's public issue templates.