Report it privately through GitHub's security advisory form, never in a public issue. The first response comes within 7 days.

In scope: every plugin under plugins/, its prefixing configuration and its workflows, and the monorepo's own workflows.

Out of scope, reported upstream instead:

• the wp-framework packages, to ahegyes/wordpress-framework;
• WordPress, WooCommerce and the other Composer and npm dependencies, to their projects.