Please don't report security vulnerabilities in public issues, pull requests or discussions.

Report them privately through GitHub instead:

1. Go to this repository's Security tab.
2. Choose Report a vulnerability.
3. Say which version or commit is affected, what an attacker can do, and how to reproduce it.

Only the maintainers can see the report. It can be talked through there, fixed, and published as an advisory when the fix is out.

Security fixes go into the latest release.