# Security

Please do not open public issues for security-sensitive reports.

Send a private report to the repository owner with:

- affected version or commit
- reproduction steps
- impact
- any suggested mitigation

Ledger source records can include project paths, internal notes, and release
history. Do not commit secrets, credentials, private keys, production data, or
private customer information to Ledger records.