Instead of opening a GitHub issue for security vulnerabilities, send an email to [email protected] with the bug report. Please write it up as you would a GitHub issue.