Do not open a public GitHub issue for a security vulnerability.

How to report one, and how to verify a release, is the same for every repository: see Security on the organization page.