Security vulnerabilities can be reported privately to [email protected]. Please see our Security Vulnerability Disclosure Program for the GPG key and more information.