The latest minor release is supported and receives security updates: https://github.com/deskflow/deskflow/releases

Please report vulnerabilities privately, not on the public issue tracker.

Use GitHub's private reporting form: https://github.com/deskflow/deskflow/security/advisories/new

That opens a draft advisory only visible to maintainers. Include a proof of concept if you have one.

We land the fix on master, ship it in a continuous build, then publish the advisory and proof of concept together, so a fixed build is always available at the point the details go public. You will be credited in the advisory unless you ask otherwise.