Report security issues privately via GitHub's "Report a vulnerability" link on the Security tab.

I aim to acknowledge within 7 days. Coordinated disclosure preferred.