There's a specific issue template to report security vulnerabilits, feel free to open a new one! Having just a few dependencies, it is unlikely your report it is going to be disregarded.