Email [email protected] or open a private security advisory on GitHub. We aim to respond within 72 hours.