Only the latest release receives security fixes.

Please report vulnerabilities privately through GitHub's private vulnerability reporting, not in a public issue.

Include the affected version, how to reproduce the issue, and its impact.

Reports are acknowledged within 14 days. A confirmed issue is fixed in a new release and published as a GitHub security advisory, crediting you unless you prefer otherwise. Please keep it private until then.

Some behaviour is by design and documented under Security Considerations, for example that /probe is unauthenticated unless --web.config.file enables basic auth.