Instead of opening a GitHub issue for security vulnerabilities, send an email to secure@expo.io with the bug report. Please write it up as you would a GitHub issue.