Only the latest App Store version and the latest release get fixes.

Please report it privately through GitHub's private vulnerability reporting, not in a public issue. I'll reply as soon as I can and credit you in the fix unless you'd rather stay anonymous.

Aura has no account and no analytics, and sends nothing to its developer. It talks to the Navidrome or Subsonic server you add. Your server password stays in the Keychain on your device.