Report suspected vulnerabilities privately to security@polymathrobotics.com. Do not open a public issue, pull request, or discussion for a security problem.
The full policy (scope, what to include, response times) lives at https://polymathrobotics.github.io/protective-stop/developing/security.