Security Policy Report vulnerabilities privately. Include impact, steps to reproduce, and affected commit/version.