Report it privately through GitHub: open the security advisory form, or email team@frame.dev. Do not open a public issue, pull request or chat message about a vulnerability.

A maintainer acknowledges a report within 5 business days and sends an assessment and a plan within 14 days.