Please report security issues in private first. Either do a vulnerability report on Github, or email it to [email protected].