There are no versions with security updates.

They can report a vulnerability using GitHub's report system. So that you know- I will respond within 12 hours. If the vulnerability is accepted, I will work on a fix as Priority 0 (P0), regardless of the severity.