Do not report a security problem in a public issue, pull request or discussion.

Use GitHub's private vulnerability reporting: open the Security tab of this repository and choose Report a vulnerability. Only the maintainers of this repository see the report. The problem is discussed and fixed there before anything about it is made public.

This form is the only channel. There is no email address for security reports.