Please file a private vulnerability report via GitHub, email @longieirl, or see https://tidelift.com/security if you have a potential security vulnerability to report.