Security Policy Report vulnerabilities privately to the maintainers. Do not open public issues for active exploits.