Report a vulnerability through GitHub's private reporting form. A report there stays private.

Don't report a vulnerability in an issue, because anyone can read an issue.

dream is shared, not supported. The project promises no reply to a report, and no fix within any time.