Report a vulnerability privately, never in a public issue or pull request: use Report a vulnerability on the repository's Security tab (GitHub private vulnerability reporting).

Please include what is affected (client, server, SDK, launcher or a service), the version, how to reproduce it and what an attacker gains. You get an answer as soon as it has been looked at, and the fix goes out in a release before the report is published.

Only the latest release is supported.