Never in a public issue. Report it privately through the contact form at https://omega8.cc/contact, or through GitHub's private vulnerability report on this repository (Security, "Report a vulnerability"). The full policy is BOA's: https://docs.boa.io/developing/contributing/contributing#security-disclosure