Report a vulnerability privately: open the repository's Security tab and choose Report a vulnerability. Please do not open a public issue for it.
Say what you found, how to reproduce it, and which commit you tested.
vawe renders pages on your own machine in headless Chrome. A report about a page that escapes the renderer, reads files it should not, or reaches the network during a render is in scope.