Use GitHub's private vulnerability reporting: https://github.com/e2sy/hearth/security/advisories/new
Please do not open a public issue for anything that could put users at risk before a fix ships.
Fixes ship to main and the latest release. Older releases are not patched.