Report vulnerabilities privately through GitHub's private vulnerability reporting (Security tab → Report a vulnerability). Don't open a public issue. Include the affected packages and versions, and steps to reproduce.

Reports are handled on a best-effort basis, with no guaranteed response or fix time. Only the latest release gets fixes.