Security finding

[WesR]

Hey there!
I've been doing security research on dependencies and have found an issue. Could you enable private vuln reporting or drop contact info here or inside a SECURITY.md file? That way I can submit the findings along with a patch (if you would like).

Thanks!