For ordinary bugs, open a GitHub issue. For suspected security vulnerabilities, use GitHub's private Report a vulnerability option and do not post details in a public issue.