Only the latest release receives security fixes. Each fix ships in a new patch release.

Report it privately with Report a vulnerability on the Security tab. Please do not open a public issue.

Include the Flea version, what an attacker can do, and the steps or a file that shows it. Previews, thumbnails, archives, disk images, network shares and the file chooser all handle untrusted data, and problems in any of them are in scope.

The advisory is published with the release that fixes it, and it credits you unless you ask otherwise.