To report a security vulnerability, please file a private vulnerability report via GitHub on the affected repository, or email @ljharb.