Responsible disclosure? Never heard of that

It's a thing. I wish I knew more to speak intelligently on the subject, but privately collaborating first with the maintainers gives maintainers a time to vet if it's an actual problem and to put out a patch before it's publically released and hackers can misuse it.