You should report any vulnerabilities privately to Cito as the current maintainer of this repository, but note that he is working on the project voluntary in his spare time, so please be patient with him.

Please do not use the public Issue tracker of this repository to disclose security related issues.

Also, please keep in mind that this repository is actually a port of the GraphQL.js. Issues that also affect upstream should be also reported there.