Please do not open a public issue for security vulnerabilities.

Report them privately via GitHub's private vulnerability reporting.

I'll respond within a few days and coordinate a fix before any public disclosure.