Do not publish suspected vulnerabilities in a public issue. Use private vulnerability reporting in the affected Beans repository and include the affected version, reproduction steps, expected impact, and known workarounds.