Please do not open a public issue for security problems. Report them privately through GitHub security advisories instead.

Include the affected version, a description of the problem and, if possible, a minimal reproduction. You will get an answer within a few days; once a fix is ready, it is released together with a published advisory.