See https://tidelift.com/security for a coordinated Disclosure Plan