Only the latest release receives fixes while the project is pre-1.0.

Do not open a public issue for a security problem.

Use GitHub's private vulnerability reporting instead: Report a vulnerability.

Please include:

• the plugin and PumpkinMC version
• what an attacker can achieve, for example privilege escalation to a higher group
• the smallest set of steps that reproduces it
• any relevant permission data, with private information removed

You can expect a first reply within seven days. Fixes are released as soon as a patch is verified, and the report is credited in the release notes unless you prefer otherwise.