If a vulnerability does not compromise users' privacy or security, open a regular GitHub issue. If it does, then take great care with responsible disclosure by reporting a vulnerability on GitHub.