Please do not open a public issue for security problems. Report it through GitHub's private vulnerability reporting instead.

Include the affected version, a description of the issue, and steps to reproduce it if you have them.

You'll get an acknowledgement within a few days. Once a fix is released, you'll be credited in the advisory unless you'd rather stay anonymous.