Do not open public issues for suspected vulnerabilities or exposed credentials. Report them through ColomboAI's private security contact listed at https://colomboai.com/security. Include the affected version, reproduction steps, and impact. Never include live API tokens or customer evidence.