Report vulnerabilities privately. If the repository's Security tab offers Report a vulnerability, use it. If it does not, open an issue titled "Security contact request" that contains no details of the problem, and the maintainer will reply with a private way to send them. Never put the details in a public issue.

Include what you found, how to reproduce it, and which version or commit you tested.

Cortex has no release yet. Reports against the main branch are welcome.