Report vulnerabilities privately through GitHub's private vulnerability reporting: open the affected repository's Security tab and choose Report a vulnerability. Don't report them in Discussions or anywhere public.

No version has been released yet; reports about the current main branch are welcome. Responses are best effort while the project is maintained by one person.