Report vulnerabilities privately, not in a public issue. Contact the owner in CODEOWNERS (@ttncode) with a description and reproduction steps. Expect an initial response within a few business days.