Email security@dustinedwards.info with what you found, the version or commit, and steps to reproduce it. Please do not open a public issue for a vulnerability. The same contact is published at https://dustinedwards.info/.well-known/security.txt (RFC 9116).
Only the latest release is supported. Fixes ship as a new release.