Only the latest release (or the main branch, for projects without releases) receives security fixes.

Please report vulnerabilities privately, not in a public issue:

1. Open the affected repository on GitHub.
2. Go to Security → Report a vulnerability (GitHub private vulnerability reporting).
3. Describe the issue, how to reproduce it, and the impact you expect.

You can expect an acknowledgement within 7 days and a status update within 30 days. Once a fix is released the advisory is published, and reporters are credited unless they prefer otherwise.

In scope: code in the public repositories of @juw12 and the sites they deploy. Out of scope: third-party services and vendored third-party code (report those upstream).