To report a security vulnerability, please use the GitHub private vulnerabilities disclosure workflow. The draft advisory will be used to coordinate the fix and disclosure.