Only the latest release gets fixes. A project made from agentready owns its copy of the tooling, so update that copy from the latest release when a fix lands.

Report it privately through GitHub: open the repository's Security tab and choose Report a vulnerability. Please do not open a public issue for a security problem.

Include what an attacker can do, the steps to reproduce it, and the version or commit you tested. Reporters are credited in the release notes once a fix ships, unless they ask not to be named.