Only the latest release of esp32-audio-player receives fixes.

Report vulnerabilities privately through GitHub: open the Security tab of this repository and select "Report a vulnerability". Do not open a public issue for them.

Relevant reports include memory corruption or crashes caused by crafted input files, playlists, tags or state files, and anything that lets a nearby Bluetooth device crash or take control of the ESP32. The fix goes out as a new release with a GitHub security advisory.