Please report security problems privately through GitHub's private vulnerability reporting, not in a public issue.

Include what you found, how to reproduce it, and the impact you expect. You'll get a reply within a few days. Once a fix is released, the advisory is published with credit to you, unless you'd rather stay anonymous.

Security fixes go into the latest release.