Please do not report security vulnerabilities via public GitHub issues.

Use GitHub's private vulnerability reporting to submit a report. You can expect an acknowledgement within a few days.