For security issues--and security issues only--you may directly email Jonathan M. Wilbur ([email protected]). If you would like, you may also create an issue on the GitHub issues page, as long as you do not mention any details about the vulnerability.

If you do not hear back from him in a few days, and if the issue is of low severity, you may create an issue on GitHub, or add the details as to what it is. Remember that bad people can read GitHub issues and use that information to hack other people, so disclose information responsibly.