Do not open a public GitHub issue for security vulnerabilities.

Use GitHub's private vulnerability reporting instead — click "Report a vulnerability" on the Security tab.

Your report will be received privately. You will receive an acknowledgement within 48 hours and a resolution timeline within 7 days.