Security issues should be reported privately by creating a security advisory on GitHub.

Please do not open a public issue for anything you think might have a security implication.