Please do not open a public issue for a security problem. Report it privately through GitHub: Report a vulnerability (Security tab → Report a vulnerability).

Include what is affected, how to reproduce it, and the version or commit. Never include real tokens, keys or credentials; placeholders are enough. You will get an answer in the advisory; a fix and a release follow there before anything is made public.

Only the latest release receives fixes.