If you believe or suspect there is a vulnerability, please privately reporting it via the "Report a vulnerability" button in the "Security" tab.

See the GitHub documentation for details.