Report security problems privately through GitHub's private vulnerability reporting: open the repository's Security tab and choose "Report a vulnerability". Do not report them in a public issue.

Fixes go into the latest release.