Please don't report vulnerabilities in public issues. Use Report a vulnerability on this repository's Security tab. If that button isn't there, open an issue asking for a private contact, without details.

Include the affected file or feature, steps to reproduce, and impact. Expect a reply within a week.