Report vulnerabilities privately through GitHub on the affected repository: Security → Report a vulnerability. Please do not open a public issue.