To report security issues, use GitHub Security Advisories (GHSA) forms such as https://github.com/lima-vm/lima/security/advisories/new .

If you do not have a GitHub account, you may use email to reach out to the maintainers directly. (See the git commit logs to inspect the maintainers' email address.)