Do not paste live Cloudflare, Linear, GitHub, or tunnel tokens into issues.
If a secret was exposed, rotate it first, then report the affected scope and commit/file reference.
Report product vulnerabilities with enough detail to reproduce, but redact tenant data, webhook bodies, access tokens, and account identifiers.