The newest code version is the one to report vulnerabilities for. Code that is marked as work in progress is not affected by this policy.

Report vulnerabilities to Issues. Since this is a hobby project, I do not have a set fix schedule. I may decline the vulnerability if I don't have time or it is small. When I accept it, that means I am working on it right at that moment.