Potential security issues can be publicly reported in the same manner as non-security issues (e.g. on GitHub Issues). However, if you would like to report them privately, you can report them via email to code@jeremyevans.net.