We rely on RubyGems's security advisory process for reporting vulnerabilities https://guides.rubygems.org/security/#reporting-security-vulnerabilities

You can also reach out to the maintainers directly my email.