Please report suspected vulnerabilities privately via GitHub Security Advisories. Do not open public issues for security reports.
You should receive an acknowledgement within a few days. Please include a minimal reproduction if you can.
Pre-1.0: only the latest release line receives fixes.