Please report security issues privately via GitHub Security Advisories ("Report a vulnerability" on the Security tab) rather than opening a public issue. You will get an acknowledgement within a few days.