Open an issue indicating that you believe there's a security vulnerability, and we can coordinate further on where to move communication, disclosure timelines, etc.