Please report security problems privately through GitHub's private vulnerability reporting, not as a public issue. We'll reply as soon as we can and credit you in the fix unless you'd rather we didn't.