If the vulnerability is in an upstream codebase (Svelte for example) report it following their security policy

To report a vulnerability in this codebase, use Github's vulnerability reporting here, or email me at me@ingo.au