Report a vulnerability privately through GitHub security advisories. Do not open a public issue for it.

Give the version or commit, the steps to reproduce, and the effect. Remove keys, tokens and personal data from logs before you attach them.

Only the latest main and the latest release get fixes.