To report security issues send an email to tsk@thesimplekid.com

Security fixes are developed and disclosed in a coordinated way. Do not include exploit details in public places: issues, pull requests (titles, bodies, review comments), commit messages, or code comments. Keep public descriptions high-level until a fix has been released and disclosure has been coordinated.

Until then, send the full report to the contact above, including impact, affected versions, reproduction steps, a proof of concept if available, and a suggested fix.