Please do not open an issue for new or novel security issues!

Instead, reach out directly to security@soasis.org to disclose any serious security issue. Include as much detail as is necessary to reproduce the problem. We will do our best to work with you!