Please do not open public issues for security-sensitive reports.

If you believe you found a security or privacy issue, contact the maintainer privately first (see the repository owner profile / contact links).