If you find a vulnerability please raise an issue or create a pull-request with the fix.
Usually you will have a response within a day, but as this is a one-person project there is always a chance that I cannot reply. If you don't hear from me within a week please add a comment to get my attention. Fixes can take between a few hours to several days depending on the impact and the time I have available.