Report a vulnerability privately through GitHub's private vulnerability reporting, not in a public issue. Reports are acknowledged within a week.

Only the latest release is supported.