A researcher discovers a vulnerability and wants to report it responsibly. What should they consult before posting details publicly?

1. SECURITY.md and the project's private reporting mechanism
2. The repository topic list only
3. The newest unrelated public issue
4. A release download count