Please follow the instructions on Tidelift's security page to report a security issue.