Security Policy Report vulnerabilities via GitHub Security Advisories. Scan untrusted repositories only in isolated runners.