If you found security bugs, please do not send a public issue or patch. You can send me email at [email protected].

Or, you can use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.