Please don't report security problems in a public issue. Use GitHub's private reporting instead: report a vulnerability. It reaches @bas3line directly.

Fixes land on main.