Please do not report security problems in normal issues or pull requests, instead use private reporting of security vulnerabilities on GitHub.