Only the latest release of Padu receives security fixes. Updates ship through the in-app updater and https://padu.dev.

Please use GitHub private vulnerability reporting: https://github.com/wisnuwiry/padu/security/advisories/new

If that doesn't work for you, email wisnuwiry[at]gmail[dot]com.

Please don't open a public issue for anything you believe is exploitable before it has been fixed. Include reproduction steps and the Padu version (Padu → About Padu) you tested.