Report a vulnerability privately through GitHub's advisory form. Don't open a public issue for it.

Fixes land in the latest release only. Expect a reply within a week.