Report a vulnerability privately through GitHub's Report a vulnerability form, not in a public issue. You will get an answer within a few days.

Only the latest release is supported. Fixes are released as a new version.