Please report vulnerabilities privately through GitHub's private vulnerability reporting. Don't open a public issue.

Include the affected package and version, a description of the problem, and steps or code to reproduce it. You'll get an acknowledgement within a few days. Fixes are released as soon as practical, and the advisory is published once a fixed version is available.

Only the latest 0.x release gets security fixes.