Please do not open a public issue for security problems.

Report them privately through GitHub's security advisory form, or by email to matthewjohncoleman@gmail.com. You'll get a response within a reasonable time frame, and credit in the release notes if you'd like it.