A counterexample or a refutation that shows a memory-safety bug in a library: report it to that library first, following its own security policy. The statements and builds it affects stay out of the release ("not in this release yet"), and nothing in the repository says why.

A problem in this repository's own tools, workflows or checker: open a private security advisory on this repository.