Report it privately, never in a public issue, pull request or discussion: on the repository's Security tab, choose Report a vulnerability. The report stays visible to the maintainers only until a fix is published.

Say what an attacker can do and from where (the panel, a resource on the game server, another account on the host), against which version (observer --version prints it) and on which system, with the steps that show it. Test only against servers you run.

Observer is a proof of concept maintained on a best-effort basis. There is no supported version, no guaranteed response time and no promise of a fix or an advisory.