Please do not open a public issue for a security problem. Report it privately through GitHub's private vulnerability reporting: report a vulnerability (or, on the repository's Security tab, choose Report a vulnerability). That opens a private advisory that only you and the maintainer can see.

Include what is affected, how to reproduce it, and the version or commit. Never include real tokens, keys or credentials; placeholders are enough. You will get an answer in the advisory; a fix and a release follow there before anything is made public.

Only the latest release receives fixes.