Please do not open a public issue for security problems.

Report them privately through GitHub's security advisories instead:

1. Open the affected repository's Security tab.
2. Choose Report a vulnerability (or go to https://github.com/Tolemak/<repository>/security/advisories/new).
3. Describe the issue, how to reproduce it and the impact you expect.

You can expect an acknowledgement within a few days. Once the issue is confirmed, a fix is prepared in a private fork and released together with a published advisory that credits you, unless you prefer otherwise.

Only the latest release (or the default branch, for projects without releases) receives security fixes.