Report vulnerabilities privately to security@bitlab.dev. Do not include credentials in issues. netnotify redacts credentials by design and supports environment-based secrets, TLS and least-privilege systemd hardening.