Please do not open a public issue for a vulnerability. Use GitHub's private vulnerability reporting ("Report a vulnerability" on the repository's Security tab). We will acknowledge within a week and tell you what we will do.

Please do not send secrets, credentials or personal data in a report; describe where they are instead.