Report a vulnerability privately through GitHub: in this repository, open Security, then Report a vulnerability. Do not open a public issue.

Fixes go into the latest release only.