If you've found a vulnerability, report it in issues as a bug report explaining what's happening and how to reproduce the issue and the vulnerability tag will be added. If you are able to fix the issue with a pull request, please do so.