Don't report a vulnerability in a public issue. Use private vulnerability reporting, so it can be fixed before anyone else sees it.
Only main and the release deployed from it get fixes. There are no maintained release branches.
How executor pods are isolated and what CI scans for is in the security docs.