Dotlock encrypts development secrets, so a flaw here matters more than in most packages.
If you find a vulnerability, please do not open a public issue. Report it privately:
You will get an answer within a few days.
Only the latest release gets security fixes.