Security issue in subcommand

[ben-sleek-notarize]

Hi @jjmschofield ,

I have identified a security issue in a subcommand.

I'd like to report the details responsibly but this repository doesn't have GitHub's private vulnerability reporting enabled
and there's no SECURITY.md with contact information.

Could you either:

1. Enable https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability on this repo, or
2. Share an email address I can send the details to?