Report vulnerabilities privately through GitHub. Open the repository, choose Security, then Report a vulnerability. Do not open a public issue for a security problem.

Expect an acknowledgment within a few days. Fixes ship in the next release.