SQLAlchemy projects including Mako participate in the Tidelift security infrastructure for reporting potential vulnerabilities reponsibly. Please follow the guidelines at:

https://tidelift.com/docs/security

in order to report a security issue.