Please report security issues privately via GitHub's Report a vulnerability button rather than opening a public issue. I aim to acknowledge reports within 72 hours.

Supported: the latest released version on the default branch.