Use GitHub's private vulnerability reporting to report security issues confidentially. Do not open public issues for security vulnerabilities.

Reports are typically acknowledged within a few days, and fixes are published as quickly as severity warrants.