Report vulnerabilities via GitHub private vulnerability reporting on the affected repository (Security → "Report a vulnerability") — do not open public issues for security reports. Expect an acknowledgment within a week.