Please do not report security vulnerabilities through public GitHub issues.
The easiest way to report a security issue is privately through GitHub here.
See Privately reporting a security vulnerability for full instructions.
Alternatively, you can report them via e-mail or anonymous form to the IBM Product Security Incident Response Team (PSIRT) following the guidelines under the IBM Security Vulnerability Management pages.