Please report vulnerabilities privately through GitHub security advisories, not in public issues. You will get an answer within a week.