To report a security vulnerability, go to the "Security" tab on the affected repository and click "Report a Vulnerability" (it is the big green button).

A maintainer will reach out to you with how to proceed and any next steps.

If using GitHub's security reporting is not an option, you can email [email protected].