If you find a vulnerability, contact me at my email 5990@protonmail.com with details about it. Do NOT open an issue.

The report should include possibly affected versions, tested versions, and impact. If the report is accepted, the vulnerability will be fixed within 6 months or earlier, depending on the severity. After reasonable time, the vulnerability will be disclosed on the release notes of the version it was fixed in.