Report vulnerabilities privately through GitHub Security Advisories (Security tab → Report a vulnerability). Do not open a public issue for a security report.