Please do not open a public issue for security problems.

Report privately through GitHub Security Advisories. You should get a first response within 7 days. Once a fix is released, the advisory is published with credit to the reporter unless you prefer otherwise.