Report vulnerabilities privately through GitHub Private Vulnerability Reporting. This route also covers the embedded Library and updater. Include plugin/component versions, WordPress/PHP versions, reproduction steps and potential impact. Do not send passwords, tokens or private customer data. Do not disclose security details first in public issues or discussions. Fixes and disclosure are coordinated after assessment; no fixed response deadlines are promised.
The latest stable release is the baseline for security fixes. Use issues and discussions for ordinary bugs and questions.