Open a private security advisory on the affected repository. Use the "Security" tab, then "Report a vulnerability". Do not open a public issue for it.

Say which package and version you use and how to reproduce the problem. Never send a real API token. If a token leaked, revoke it at https://klaracase.de/settings/api-tokens.

Only the latest release gets security fixes while the SDKs are below 1.0.