Only the latest release receives fixes.

Do not open a public issue. Report the problem privately through GitHub's private vulnerability reporting. You will get an answer within 7 days.

devdash runs gh and, when installed, omp on your machine and reads their output. It does not store credentials. The only file it writes is a cache of usage figures in $XDG_CACHE_HOME/devdash/, which contains no tokens.