prefer to report security issues privately rather than in public issues.

use github's "report a vulnerability" button on the security tab, or email the repo owner directly.

the latest released version gets security fixes. older versions don't.