Report vulnerabilities privately through the repository's Security tab, using Report a vulnerability. Don't open a public issue.