Found a security bug? Please report it privately via GitHub's advisory form rather than opening a public issue, so there's a chance to ship a fix before it's public.