Report a vulnerability.
Use Contact with kind "security". Do not include secrets or personal data. Please give us reasonable time to fix before disclosure.