Email security reports privately to hello@subho.xyz. Include the affected version, reproduction steps, and impact. Do not open a public issue until the maintainers have investigated the report.
You should receive an acknowledgement within seven days.