Email athallahrikza2@gmail.com with details. Do not open a public issue for security reports.

We aim to respond within 72 hours and patch critical issues in the next minor release.