To report a security vulnerability, please use the Security Contact Information. Tidelift will coordinate the fix and disclosure.