Report a vulnerability through a private security advisory, not a public issue. You will get a reply within a few days, and credit in the changelog when the fix ships unless you ask otherwise.

Supported: the latest minor release on npm. Older majors do not receive fixes.

What the server does to stay safe by default, and what it does not promise, is written up in docs/security.md.