HTML special characters are not escaped in some PEP headers

The Docutils project recieved a security bug report regarding the Docutils PEP parser.
While the affected code is not used by "python/peps/" anymore, the problem persists in the function that replaced it in peps/sphinx-extensions.

Please advise me how to report the problem securely.
