Report it privately through GitHub's security advisory form, never in a public issue. The first response comes within 7 days, and the advisory credits the reporter once a fix is released, unless they ask to stay anonymous.

Only the latest release line of each package receives security updates:

Older minor releases may receive critical fixes at the maintainer's discretion.

In scope: vulnerabilities in this framework's PHP code or its CI configuration.

Out of scope: vulnerabilities in WordPress core, WooCommerce, or upstream Composer dependencies — report those to their respective maintainers.