To report a vulnerability, use GitHub's private vulnerability reporting:

https://github.com/alexylon/ferrocrypt/security/advisories/new