Please report security issues privately, through GitHub's private vulnerability reporting, not in a public issue. Say what is affected, how to reproduce it, and the version.
You'll get an answer within a week. Fixes go into the latest version only, which installed apps update to on their own.
Things worth reporting include: API keys leaving the system keychain or reaching a server other than the one they're for; audio, screenshots or subtitles sent anywhere the user didn't choose; updates that install without a valid signature; and bundled programs that can be made to run other code.