To report a security issue, email [email protected] and include the word "SECURITY" in the subject line.
I take security bugs very seriously. If you don't hear from me in a week then please ping me. Once I accept the report, the fix should be available and new version released within days. I will mark the bug as public after releasing a new version or declining the bug.
I support the last published branch and the last development version (master).