Do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting for this repository and include the affected version, a minimal reproduction, and the expected impact. If GitHub reporting is unavailable, email hraness@pm.me.