If you found security bugs, please do not send a public issue or patch. You can send me email at me@lepture.com.

Or, you can use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.