Read README.md, CHANGELOG.md, and the relevant documents in docs/ before opening an issue.
For a bug report, include reproducible steps, expected and actual behavior, the application version from VERSION, PHP and browser versions where relevant, and redacted diagnostic output. Never include passwords, patterns, recovery keys, plaintext, server secrets, or private signing keys.
Run php bin/self-check.php when possible and state exactly which checks you ran. If a required extension or dependency is unavailable, include that limitation.
For sensitive vulnerability reports, follow SECURITY.md rather than posting details publicly.