Report vulnerabilities privately through GitHub's vulnerability reporting, not in public issues. Include affected versions, reproduction steps and impact. A maintainer acknowledges a report within a week and coordinates the fix and disclosure with you.

Fixes go into the latest release. The security model describes the intended boundaries and current limits.