To report a security vulnerability, use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.