Please don't open a public issue for security problems. Report them privately through GitHub's private vulnerability reporting instead.

Include what you found, how to reproduce it, and the affected version or commit. You should get a reply within a week.

Only the latest commit on main (and the web viewer deployed from it) receives fixes.