Please report security problems privately, not in a public issue:

1. Open the repository on GitHub.
2. Go to the Security tab and click Report a vulnerability.
3. Describe the problem, how to reproduce it and what an attacker could do with it.

You will get an answer as soon as possible, usually within a week. Please give a reasonable time to fix the problem before you publish details.

Only the latest release (or, for projects without releases, the main branch) receives security fixes.