If you discover a vulnerability, please report it through GitHub's Security Advisories:
https://docs.github.com/en/code-security/security-advisories

We do not accept vulnerability reports via other channels.