Please don't report security vulnerabilities in public issues.

Instead, report them privately using the Report a vulnerability button on the repository's Security tab (GitHub private vulnerability reporting). If that isn't available for the repository, email ben@balter.com.