Email side.codes@gmail.com rather than opening a public issue, with the affected version and what an attacker could do, and keep it private until a fix is released.

Fixes go into the latest release.