Please don't report security problems in a public issue, pull request, commit message or test name.

Report them privately instead, with the Report a vulnerability button on this repository's Security tab (Security → Advisories). The report stays private until the maintainers publish an advisory.