Security fixes are applied on the master branch and included in the next tagged release.
Please do not open a public GitHub issue for security reports.
Use one of:
Include the affected revision, a short description of the impact, and a way to reproduce the issue. We will acknowledge the report and coordinate a fix and disclosure window.