When reporting a security issue, do not create an issue or file a pull request on GitHub. The reporting process and disclosure communications are outlined here.