Report vulnerabilities privately through GitHub's Report a vulnerability button. tagscope parses untrusted files, so crashes on crafted input count.