Please do not report suspected security vulnerabilities through public issues, comments, or pull requests. Follow the process described in the Infineon Vulnerability Notification Process (PDF) to report a security vulnerability. Use the reporting channel specified in that document to share the affected extension version, operating system, a description of the potential impact, and minimal reproduction steps. Do not send live credentials or confidential customer projects. Agree on a secure transfer method with the responding team if additional sensitive material is needed.

Do not assume that an ordinary GitHub issue is private. Keep technical details in the private reporting channel while the report is being assessed.