To report a vulnerability please submit a Private vulnerability here: https://github.com/dominikwilkowski/vault/security/advisories/new

Vulnerability disclosures have a 30 day turn around time.