Please don't open a public issue for a security problem.

Report it privately through GitHub instead: open the Security tab and choose Report a vulnerability (or go straight to the private report form). Only the maintainer can see the report.

Please include what you found, how to reproduce it, and which version or commit you tested. You'll get a reply as soon as possible, and credit in the fix's advisory if you'd like it.

Only the latest release (the main branch) gets security fixes.