Report vulnerabilities privately through GitHub Private Vulnerability Reporting:
https://github.com/wranngle/orb_forge/security/advisories/new
If that link is unavailable, email cody@wranngle.com.
Expected response: best-effort acknowledgement, typically within 7 days.