Security fixes are made on the latest released minor version. Users should upgrade to the newest patch before reporting a suspected vulnerability.
Use GitHub's Security → Report a vulnerability flow for this repository. Do not file a public issue for exploitable behavior. Include affected versions, a minimal reproduction, impact, and any known mitigation. Maintainers will confirm receipt within five working days and coordinate disclosure after a fix is ready.