If you find a vulnerability in the latest version, please submit a private advisory.

If it's low severity (use best judgement) you may open an issue instead of an advisory.