Only the latest release is supported. A fix reaches users in the next release: the Homebrew cask, crates.io, the .deb and .rpm packages and the archives on the releases page.

Report it privately through GitHub private vulnerability reporting. Only the maintainer can see the report. Do not open a public issue, pull request or discussion about it.

Include:

• what an attacker can do and what they need for it;
• the steps that show the problem: for example, the repository layout or origin URL and the kraken command you ran;
• the command, version file or module involved.

The maintainer replies in the advisory, agrees on a fix and a disclosure date with you, and credits you in the advisory unless you ask not to be named.