Please email me at samuel at samuellucas dot com using an informative subject line or use GitHub's Advisories page. I will respond as soon as possible.
Assuming consent, your name and a profile of your choice (e.g. GitHub) will be acknowledged in the GitHub release that patches the vulnerability and on the website. However, I cannot currently afford to give cash rewards.