Hi there,

Since this is a high-profile package on npm and many GitHub repositories rely on it for isolation, I was wondering if disclosure of security issues shouldn't be done in a more organized/principled way? If you agree with me, please create a security policy (https://github.com/patriksimek/vm2/security/policy) with a security email address for the volunteers to report to. Additionally, it would be great to have security advisories (https://github.com/patriksimek/vm2/security/advisories) for past breakouts so that users are informed when they install a vulnerable version. Here is a possibly incomplete list of them:

#76
#187
#197
#224
#225
#268
#276
#285

Best,
Cris