I do not know how to responsibly disclose vulnerabilities to open source projects, round 1

[eddieran]

I really don't. And that's why @michaelklishin has cleared this issue: irresponsible disclosure is bad, mmmkay?

[michaelklishin]

@eddieran ever heard of the concept of responsible disclosure and GitHub's security advisory feature?