Report vulnerabilities privately through GitHub's security advisories. Do not open a public issue for anything exploitable.

Reports are read and answered, and fixes target the latest release line.