Report vulnerabilities privately through GitHub security advisories. Treat grids, budgets, and candidate sources as untrusted; enforce caller limits and never permit unbounded search.