Email support@three.ws with a description and reproduction steps. Please do not open a public issue for a vulnerability. We acknowledge reports within 3 business days.