Report security issues privately through GitHub Security Advisories:
https://github.com/1gr14/flat/security/advisories/new
If you can't use that, email s@1gr14.dev.
Do not open a public issue for a security problem. Include the steps to reproduce it, the affected version or commit, and any known fix.
Fixes ship in the latest release line. Older major versions are fixed at the maintainer's discretion.