Please do not report security issues in public issues or pull requests. Use private vulnerability reporting so the maintainers can investigate before disclosure.