Please open a issue with the tag vulnerability or bug when you find a security issue or a bug, even when you are not 100% certain that it is actually a security issue or a bug. Typically, you will receive an answer within a day.