Use GitHub's private Report a vulnerability form. Include the affected protocol version or commit, reproduction steps, impact, and relevant deployment settings with credentials and private data removed. Please keep exploit details out of public issues while a report is being investigated.

Check whether an issue is still present on the latest release. Older releases do not have a guaranteed security backport schedule. Report suspected vulnerabilities even if you cannot reproduce them on the latest release.