Report vulnerabilities privately through GitHub Security Advisories. Prompts may contain private instructions or context; sanitize public examples. Unintended file access, unsafe report rendering, content disclosure, and dependency concerns are in scope.