Use GitHub's private vulnerability reporting. Do not open a public issue for a security problem.

This is a hobby project maintained by one person in their spare time. Expect a first response within two weeks.

There is no support window for older versions. A confirmed report is fixed in a new release; run the latest tag.