Report it privately through GitHub: open the repository's Security tab and choose Report a vulnerability. Please do not open a public issue for a security problem.

Say what you did, what happened, and which version or commit you ran. I aim to reply within 14 days.

Only the latest release of each project gets security fixes.