If you think you've found a vulnerability, please use the private vulnerability reporting form provided by Github.