If the vulnerability is not critical, make an issue here.

Critical vulnerabilities should be fielded directly to me at this email: [email protected]

I should respond within a day or two unless I'm on vacation. If I'm on vacation, I'll probably respond on the same day.

Jokes aside, vulnerabilities are taken seriously. You should expect regular updates on the mitigation strategy and timeline.