I'll take this time to say that every open source project should have a contributing file with a way to report security bugs properly. It's as simple as providi

I'll take this time to say that every open source project should have a contributing file with a way to report security bugs properly. It's as simple as providing an email address for security bugs. In this case, yes. Dig up any info to try to contact the author privately.