Only the latest release gets patches.

Use GitHub Security Advisories. Don't open a public issue.

I'll fix confirmed vulnerabilities and credit the reporter unless they prefer to stay anonymous.