Security fixes go to the main branch and the latest release.

Do not open a public issue. Report it privately through GitHub's private vulnerability reporting. You get an answer in the advisory thread, and the fix ships with a published advisory.

For how the recipe handles credentials and remote access, see docs/security.md.