Security fixes target the latest released minor version.

Do not open a public issue for an unpatched vulnerability.

Use GitHub private vulnerability reporting:

1. Open the repository Security tab.
2. Choose Advisories.
3. Select Report a vulnerability.

Include affected versions, reproduction steps, impact, and any suggested fix. Expect acknowledgement within 5 business days. No bounty is promised.