Please report security issues privately through GitHub's private vulnerability reporting: open the repository's Security tab and choose Report a vulnerability. Do not open a public issue for a security report.

Include as much as you can:

• a description of the vulnerability,
• steps to reproduce,
• the potential impact, and
• any suggested remediation.

You can expect an initial response within a few days, and updates as the report is triaged and addressed.