If you have discovered a vulnerability inside the project, report it privately via GitHub's private vulnerability reporting. This way the maintainers can work on a proper fix without disclosing the problem to the public before it has been solved.