Do not disclose a vulnerability in a public issue. Use GitHub's private vulnerability reporting for this repository. If that facility is unavailable, open a public issue containing no sensitive details and ask the maintainer for a private contact channel.