Report vulnerabilities privately through GitHub: Security tab -> "Report a vulnerability". Do not open a public issue. Expect an acknowledgement within a few days.

The package reads files you give it and has no network code and no dependencies. Releases are built and published only by the GitHub Actions workflow, through PyPI trusted publishing (no long-lived token exists).