found a vulnerability? please report it privately — in this repo's Security tab use "Report a vulnerability" (private vulnerability reporting is on), not a public issue.

i'll respond as fast as i can. thanks for reporting responsibly.