Do not open a public issue for a security report. Use this repository's GitHub Security Advisories page and select Report a vulnerability.

The maintainers will acknowledge the report and coordinate a fix privately.