Please do not file a public ticket mentioning the vulnerability.

Reach out in Discord for disclosing a vulnerability. Do not disclose directly in the channel, but inform that you have a vulnerability to share and then wait for DM from one of the members/devs.