This project is experimental and pre-1.0.
To report a vulnerability, open the repository's Security tab and choose Report a vulnerability. Do not open a public issue. The report stays private between you and the maintainers.
There is no promised response time.