Security bugs should be reported directly to [email protected]. Low risk security bugs can be reported by opening an issue here. If you are unsure about the risk level, please report it via email.