Please go to Security Advisories to privately report a security vulnerability, our contributors will try to respond within a week of your report with a rough plan for a fix and new tests.