Report vulnerabilities privately through GitHub security advisories. Do not open a public issue.

Include the affected version, a description of the problem and, if possible, a minimal reproduction. Once a fix is released, the advisory is published with credit to the reporter, unless you prefer otherwise.