Do not report vulnerabilities in public issues, discussions, pull requests, or other public channels.
Use GitHub's private vulnerability reporting: the docsy/docsy advisory form. If you cannot use GitHub, email chalin@cncf.io.
A maintainer will triage your report privately; valid issues will be fixed and, when warranted, disclosed through a GitHub security advisory, which credits you if you accept.