Please do not report security vulnerabilities through public GitHub issues.

You can reach out directly to @irhm:matrix.org on matrix to discuss the vulnerability or you may draft a new security advisory on this repository.