Please report vulnerabilities privately, not in a public issue. Email [email protected], or use "Report a vulnerability" on the repository's Security tab where it is enabled. These are research projects, so replies may take up to a week and there is no bug bounty.