What to report
Include a concise description, affected endpoint or product area, reproduction steps, and potential impact.
What not to include
Never publish credentials, personal data, or customer records as part of a report.
After disclosure
Keep the communication channel available for clarification while the issue is assessed, mitigated, and documented.
Review the full security model
See the complete set of security controls and enterprise requirements.