Do not report plugin supply-chain vulnerabilities in public issues.

Use GitHub private vulnerability reporting on t8y2/dbx or t8y2/dbx-store when available. Reports should identify the affected plugin ID and version, artifact URL and SHA-256, signing-key ID, and the specific review or distribution risk. Do not include private signing keys, tokens, or credentials.