Security fixes are made on the default branch until the first tagged release, then on the latest supported release.

Please report vulnerabilities privately through GitHub Security Advisories, not through a public issue.