Report it privately through GitHub: on https://github.com/keyline-dev/keyline/security, choose Report a vulnerability. Please don't open a public issue for it. You'll get a reply within a few days, and a fix ships in a release with a note in its release notes.

Only the latest release gets security fixes.

Bugs and questions: https://github.com/keyline-dev/keyline/issues.

What keyline reads, fetches and refuses is in docs/tools.md; what it sends over the network is in PRIVACY.md.