If you discover a vulnerability, email [email protected]. Do not file a public issue before it is patched.