Please do not report security vulnerabilities through public GitHub issues.
Use GitHub's private vulnerability reporting instead. This keeps the issue confidential until a fix is ready.
Include as much detail as you can: steps to reproduce, impact, and any suggested fixes.
You'll receive a response within 7 days. If the issue is confirmed, a patched release will be cut as soon as possible.