Please report security vulnerabilities responsibility by emailing [email protected].

We will fix the vulnerability privately, push a new release, and then go public with the notification.