To report a vulnerability, just open an issue in the repo in the "Vulnerability" format.

We will try our best to get an answer for it in 2 days. Whether the vulnerability is accepted or declined, we will update the issue. If the vulnerability is accepted, we will do our best to solve it quickly (or accept PRs that do) If not, we will add reasoning to the issue and close the issue for the moment.