Please do not report a vulnerability online and rather contact us via Github so we can manage it. You'II be credited once the patch is published. Please use the following PGP key to encrypt data and send yours so we can exchange privately.
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQGNBGVVKxsBDAC10Q+A24nPqoVtciYRZWrHXcJyp/9No+vpn/xvGd2C4POLaRKr
v0dDItTk9o2abfg3AHvRraw4LRhLY+6RiDkyXC/fuFZjYCg1uidRK6RGXx/t2Fjg
v4uiMNo4Y8ERKJuAyNnBiM7Tn5+p4H50FdjkN7VRkgAm9sBS9fbtLZp7hqgaA9Gp
JvAvUiLWIBG1/nNSCVLV4WXph8TFxp8YbcRNe7HmYL3MmL0Bt/tAe9r22JRGPH7/
7ThdcWFCxC6cnde2sY1+txQnkOtL/cn3cbgVEPWIPbW7DdmIvM7M7daXXI92rm+B
2es9PTD03qvxmIfTkLb4M6zqr0KPlb89r4J/UWUSTHBbvU818vkDemm3KIdtdTKl
N5exGO26EurFTcg936fnY2pNIUtk6WTzLAj0p+iI4L66t82ZyjqKeo9XsIQKgXOl
4CFT+20deLx8KOGuh6/KfOiVa2RI+Hsjr8FUAXL1J3td3jcVkrFxDvECZyfsOijS
5hUWp2cUNmtA2vkAEQEAAbQ+RG9yaWFuQ29kaW5nIDwxMDg1OTM2NjIrRG9yaWFu
Q29kaW5nQHVzZXJzLm5vcmVwbHkuZ2l0aHViLmNvbT6JAdQEEwEKAD4WIQSqmjn9
HlmJcxEJdpsftX6STAycJQUCZVUrGwIbAwUJA8JnAAULCQgHAgYVCgkICwIEFgID
AQIeAQIXgAAKCRAftX6STAycJb+nDACKs+dIKPnnQccjyZ+Zb+naTCum2+35VkFv
R8eAs1NfT9PgljyydBseeEKeibMbYqIraqL7e3Yq98dL3RU19+yA2PpxNmpsK6gH
oBcDOe7ojA8nJ9pe/C8B1hk/FzCGUHFvyrXvmr0dj7ehKAYDOyEO63BwCwRHgJbw
IK0gdUxefW3KmgH+Ge+hAs+vk+RSuq+fe0HCQ6GIufUNYV1LFSZp8ojX8f/eTpa/
o1/SQ2yuOxUo1DpScSOPDYAGx7xFcqO1RNJm/CRqFPHVypMpdLoo7WU6J0cfHhTY
+7/PeRzIXv1zEI7sCQR5WBslFD67Hrw5gvvRss5DWssa17iXug0Bdmfubn/lBApS
kqYqM3QIohOdB7eJ8JTBzIPwSdvyuvAxiyBbHQ1azWL7MMdMy6a8poEcHe/VAXzA
B2IjuiUgDteaCXI5myEaU5bIGwuzQsHHT2O5VigIOlFOSNwSMOw0b1Uj0Skw43Vh
AsoYzascPrjvk9PSaDzYNbs7r9q+HQa5AY0EZVUrGwEMAM2Slo/HLWDkudjcMxWI
mJKIbmhY1L2utXdeGKC5pLhXs02xic7Hs9TpDJcLslX+kpi765Sfg0UtIU/atZqA
dNAJ2Uz+ModnhANbtzeiBnPZMRPzymlxQKq/hb8LIuOkwTAGC4THeW344nxBYl5A
DJqr50VOiQmfi3xGz3banbQPLJMVwc4XvG/QlEP7PKvr/LOIlcr16f4rMNYfHJg6
v2tFXT3YUI0XHX+gnmZVa0iBb799CkrxnAQkVZ4JPlJi2FidwqV64eFocR96u9Hz
jEp/mHXOx8NmwnnYJJ8BcMqXhDt3ob7YzSODZhyCL9wm6D2YHpe799ALrBHLQizD
j4RxVAb5NRXY5gqaMyeB28+6uKizExm1Qu4CXI8f+d2+bAOgNtskUz/9UV/u9cyY
ll9AYB1Z4gCRdXLR/dKMal6UCMjZY1MHQzobs3kU2A7rGcPESHnScXFXG79hJk6g
m6ubfIbxn/J+N4d9EKeMaoj5lC2H5I1Tsm/uwoS3YhFhXQARAQABiQG8BBgBCgAm
FiEEqpo5/R5ZiXMRCXabH7V+kkwMnCUFAmVVKxsCGwwFCQPCZwAACgkQH7V+kkwM
nCWcMgv+PCUA/BMIw2aHDtZZRa/gjrdUTwHkeQbqr5pzmTEGovX4gSQUTEbARDkK
dLwCWCkly4IpRq9jUWwikpLG41K92iPX7Gor8wv2ymOBLDij6J4JA4pO4HDu65FY
Ut83Jy03H0weiH/qrl9ZFoEC4uN9QKt3l+yU16F5Yrwpccj1d1GDMiIuLYk9VrXI
7McxxfzDE7bQaCn/CVZagLbI5o9IK2Z2c59g1mC0Q6nAfgGs6WU7MHf9A7UTS2gy
XgChbufnj8J5uUZcwGeJyiy1hcz9JXCiBR/JKjY/9YcDHITYkcdPTYqYDtyGZvlA
gQBJZ4qLBPocw+5xqOCWxyDfdfNQ1TQ1az7pM9N9L+Hy93MGR8+LBTFfNsI6iX7a
+zoq2n3M4EsQrD14I1/Cd5DlQNAKM61YolYjxvpozSMQOzZROf/3hdkTa3JYyEko
BDgXOO0zX8ULsYiSz+lihEToHIiTXajwWHg4EJOVxQ3QnpgqqAo9hr8+JhpSrwjc
ddNVceMH
=7FbF
-----END PGP PUBLIC KEY BLOCK-----