You can report any critical security issues directly to the developer through the contact form on their personal website.

Do not report security issues on GitHub or on the WordPress.org support forums. Thank you.