Report a vulnerability privately by mail to [email protected], the contact in https://www.hackersandwizards.dev/.well-known/security.txt, not in a public issue. Fixes ship as a new release tag; only the newest tag is supported.