Please report security vulnerabilities by email to [email protected].
This email is an alias to a subset of the scikit-learn maintainers' team.
If the security vulnerability is accepted, a patch will be crafted privately in order to prepare a dedicated bugfix release as timely as possible (depending on the complexity of the fix).
In addition to sending the report by email, you can also report security vulnerabilities to Tidelift.