If you suspect you may have found a security vulnerability, please do not open a public issue or pull request. Instead, please send us a private advisory.
You should hear from us within a week, though we aim to release patches as quickly as possible. The last two security patches were released within a few hours of being reported privately to us.