Do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting for this repository and include the affected version, a minimal reproduction, and the expected impact.