Only the current source line receives fixes. These tools use heuristics; a clean report is not proof of safety.

Do not put secrets or private repository data in public issues. If the repository offers Security → Report a vulnerability, use that private reporting route. Otherwise open a minimal issue requesting a private contact without including the vulnerability details.

Use synthetic reproductions. Review screenshots, paths, URLs, headers and logs before sharing. Rotate any credential that has already been exposed.