Do not open public issues for vulnerabilities. Once the public repository exists and private vulnerability reporting is enabled, use its Security tab and Report a vulnerability form. Until that monitored route exists, no private reporting channel is advertised. Supported alpha releases receive fixes on a best-effort basis.