Only the latest release receives security fixes.

Please report privately via GitHub's "Report a vulnerability" (Security tab) — not in public issues. You should get a response within 7 days. Coordinated disclosure; happy to credit reporters in the advisory.

SheetDiff is self-hosted: reports should assume the reporter can run the code.