If you find a vulnerability, please open a Security Advisory rather than a public issue.

This is an open-source project. Do not publicly disclose vulnerabilities before they are fixed.