Please do not open a public issue for security vulnerabilities.

Instead, report them privately via GitHub's private vulnerability reporting.

You'll get an acknowledgement as soon as possible, and we'll keep you updated as the issue is investigated and fixed.