Do not open a public issue for a suspected vulnerability that could expose users. Report it privately through GitHub's security advisory interface for legrab/pocok.

Only the latest released major version receives security fixes unless a release note states otherwise. No package currently has a supported public release.