Report security issues privately through GitHub private vulnerability reporting: use the "Report a vulnerability" button under this repo's Security tab. Do not report them in public issues or PRs.