Do not open a public GitHub issue for a security report.

Report it privately through GitHub: Report a vulnerability. The report is visible only to the maintainers, and the fix is prepared in a draft advisory.

No GitHub account? Email security@simtabi.com.

Acknowledgement within 48 hours.

This package is proprietary (LICENSE). Its repository is public so the source can be read and reported on; that grants no licence to use it.