Please do not open a public issue. Report it privately through GitHub's private vulnerability reporting.

Include what you found, how to reproduce it, and its impact. You can expect an acknowledgment within a few days and a fix or mitigation plan once the report is confirmed.

Only the latest release receives security fixes.