Report suspected vulnerabilities through GitHub private vulnerability reporting. Do not file public issues for vulnerabilities until a fix and disclosure plan exist.