Please do not report security vulnerabilities through public issues. Use GitHub's private vulnerability reporting ("Report a vulnerability" in the Security tab) instead.