To report a vulnerability, use GitHub's "Report a vulnerability" feature.

This project follows a 90-day disclosure timeline.