Please do not open a public issue for security vulnerabilities.

Instead, email me directly at the address on my profile. I'll aim to respond within 72 hours and will coordinate a fix and disclosure timeline with you.