Security fixes are made on main and in the newest published release line. Older release lines are not supported unless a maintainer states otherwise.

Do not open a public issue for a vulnerability that could put users at risk.

Report it through GitHub's private vulnerability reporting. The issue tracker is appropriate for security-hardening suggestions that do not disclose an exploitable vulnerability.

Include the affected version or commit, impact, reproduction steps, and any mitigation you can safely provide. A maintainer will assess the report and coordinate any fix and disclosure; this project does not promise a response or release timeline.