To report a security vulnerability, open the affected repository’s Security tab and select Report a vulnerability.

Do not report security vulnerabilities via public issues, discussions, or pull requests.