Report a vulnerability privately, never in a public issue: open a security advisory on the repository concerned (for the engine and the Studio, https://github.com/Quest-n-Click/quest-n-click/security/advisories/new).

Supported versions and the full policy: Security policy.