Report a vulnerability privately through GitHub's security advisories, not in a public issue. Fixes go into the latest release.

What Foreman can reach, what it sends where and how to keep it to people you trust: Security and privacy.