Only the greatest published version (according to semver) will be supported. This version will be indicated as the "Latest Release" on GitHub Releases.

Use GitHub's builtin reporting mechanism. Go to Security tab -> Report a vulnerability.