Please do not report security vulnerabilities as public GitHub issues.

Use GitHub's private advisory system: Report a vulnerability

Include a description of the vulnerability, steps to reproduce, and potential impact.

I will look into reports as time allows — this is a hobby project with no guaranteed response time or fix schedule.