Our security policy is simple. If you find a vulnerability, let one of the maintainers know by raising an issue. We will respond and work with you on the issue.