Please report vulnerabilities on this page. We will probably respond within 3 days.
We will usually fix the vulnerability within a month, and publish the patch and report as soon as the fix is complete.