Please report security issues in private first. Either do a vulnerability report on Github, or email it to fox@varb.in.