Development covers building, testing and running tamis locally. Keep each pull request to one change, with its tests.
A wrong triage is worth an issue, but describe it without the report: never paste an embargoed advisory, its identifier or the comment tamis posted on it. Report a vulnerability in tamis itself through the security policy.