Report a vulnerability privately through GitHub's private vulnerability reporting, not in a public issue. Only the hosted instance and the main branch are supported.