If you believe there's a vulnerability that shouldn't be disclosed before an immediate patch, feel free to DM me (Vurv aka 0x76757276) on Discord.
If you are more technically inclined or do not wish to use Discord, private security vulnerabilities are enabled on this repo.