Report vulnerabilities privately via GitHub Security Advisories ("Report a vulnerability" on the affected repo), not a public issue. We aim to acknowledge within a few days. Do not include exploit details in public channels.