Report a vulnerability privately through GitHub's security advisories, not in a public issue.