Significant security vulnerability in this repo and on wpt.live

[dneu2]

I'd like to disclose this responsibly. Please let me know the best way to disclose details about this vulnerability privately.

Thanks,
Dan