Only the latest version published on pub.dev receives fixes.

Open an issue titled "Security report" with no details in it. The maintainer then offers a private channel where you can send what you found. Please do not post details publicly until a fix is released.