Do not open a public issue. Report it privately through Security > Report a vulnerability in the affected repository.

Include the affected version, steps to reproduce and the impact. A maintainer replies within 7 days.

Security fixes go into the latest release only.