Please don't open a public issue for security problems.

Report them privately through GitHub instead: open the repository's Security tab and click Report a vulnerability. Only the maintainers can see the report.

We're a small team and aim to reply within a week. We'll keep you updated until the issue is fixed, and credit you in the release notes if you'd like.