Report security issues privately to the repository owner via GitHub Security Advisories (repo > Security > Report a vulnerability). Do not open a public issue.