Security fixes are released for the latest minor version.

Do not open a public issue. Report it privately through GitHub security advisories. You will receive an answer within seven days, and a fix or a mitigation plan as soon as the report is confirmed.

A protection level in the taxonomy that is too low for a kind of data is also a security issue: report it the same way.