If you would like to report a public issue (for example, one with a released CVE number), please report it as a GitHub issue. If you have a patch ready, submit it following the same procedure as any other patch as described in CONTRIBUTING.md.
If you are dealing with a not-yet released or urgent issue, please contact us via our Product Security team, including as many details as possible: including the version, and any example code, if available.