To report a vulnerability, you can use private reporting. Check the docs for this. You can also specify if you want to be named with the fix and security advisory statement that will be published alongside.

Thank you for your contribution.