Security fixes go into the latest release on PyPI (blenderui) and into the main branch.

Please don't open a public issue for security problems. Report them privately through GitHub's private vulnerability reporting. Include steps to reproduce, the affected version and platform, and the impact.

You'll get an acknowledgment within a week. Once a fix is released, you'll be credited in the changelog, unless you'd rather stay anonymous.