Found something that doesn't look right? Thank you for taking the time to report it. Please use GitHub's private vulnerability reporting rather than a public issue, so there's time for a fix before the details are out in the open.
Include whatever detail you can (steps to reproduce are gold). You'll get an acknowledgement within 7 days, and a fix or a plan within 90. Please hold off on public disclosure until a fix has shipped; every report is appreciated, even the false alarms.