Please report vulnerabilities privately through GitHub's security advisory form rather than in a public issue.

Fixes go into the latest 0.x release; earlier versions are not patched.