If you think you have discovered a security issue in any of the code, please let us know. We take all security bugs seriously and if confirmed upon investigation will patch it within a reasonable amount of time and release a public security bulletin discussing the impact and credit the discoverer.
There are two ways to report a security bug. The easiest is to submit a report to Hackerone that includes a description of the flaw and any related information (e.g. reproduction steps, version).
The other way is to file a confidential security bug in Github.