Please do not open a public issue for security problems.

Report vulnerabilities privately through GitHub: Report a vulnerability

Include what you found, where (file or URL), and steps to reproduce. You'll get a response as soon as possible, and credit once a fix is out if you'd like it.

Only the latest version on the main branch (and the latest release, where there are releases) receives security fixes.