Be decent. Assume the person on the other end is trying to help, is doing this in their spare time, and may be writing in their second or third language.
Review the code, not the person. "This drops the error" is a review. "Did you even test this" is not, and it makes the next person hesitate to open a pull request at all.
English and Vietnamese are both fine. This project is built in Vietnam for a Vietnamese market and most of its history is in English. Nobody's contribution is worth less for arriving in the other language, or in imperfect either.
Say when you are stuck. An unfinished pull request with a question in it is more useful than silence, and far more useful than a rewrite that goes the wrong way for a month.
Harassment, personal attacks, dismissing somebody on the basis of who they are rather than what they wrote, or publishing somebody's private information. Sexual attention or imagery has no place here.
Report to the maintainers privately — through a security advisory if you would rather it stayed out of the issue tracker, which is a reasonable thing to want.
Reports are handled by the maintainers, who will keep the reporter's identity to themselves. Consequences run from a private word to a permanent ban, in proportion to what happened and whether it happened before.
This is adapted from the Contributor Covenant, version 2.1.