Do not paste passwords, recovery links, auth tokens, or magic links into the report. If the issue involves sign-in, you can include the account email address in the GitHub form without including the secret itself.