Please report vulnerabilities privately through the repository security advisory workflow. Do not include credentials or private transcripts in an issue. Pre-1.0 releases receive security fixes on the latest minor release.