Security issues should be reported via GitHub Security Advisories at this repo. Do not use the public issue tracker for security reports.
You should receive an initial response within 72 hours. Confirmed issues will be prioritised over feature work and released as patch versions.
Only the latest minor release receives security fixes. Pin to a recent version to receive them.