To report a security issue, either report it privately on GitHub (preferred) or through the Tidelift security contact. Do not report them on the public issue tracker.