Report privately using GitHub's advisory form:

https://github.com/sipsorcery-org/sipsorcery/security/advisories/new

The same form is reachable from the repository's Security tab via the Report a vulnerability button.

Alternatively an email can be sent to admin@sipsorcery.com.