If you think you've found a vulnerability, please use the Report a vulnerability button found in the security tab of the project on Github.

This process is documented in GitHub's Secure Coding guide: Privately reporting a security vulnerability.