Do not open a public issue for a suspected vulnerability or include private file contents in a report.

Use GitHub's private vulnerability reporting to report the issue. Include the BundleSafe version, IDE build, operating system, impact, and minimal reproduction steps. Remove credentials, proprietary translations, customer data, and unrelated project files.

Ordinary bugs and feature requests belong in the public issue tracker.