Do not open a public GitHub issue for a vulnerability.

Report it privately via GitHub private vulnerability reporting.

The latest @mba-ai/core on npm is the supported release.