Please do not open a public issue for a vulnerability.
Use GitHub's private reporting: https://github.com/nirholas/fletcher/security/advisories/new
You will get an acknowledgement within 3 business days and a status update within 10. Fixes ship in the next release with credit to the reporter unless you prefer otherwise.
In scope: this repository's code and its documented configuration. Out of scope: third-party services it talks to, and findings that need a compromised machine or a leaked key.
The latest release (or the default branch when there are no releases) receives fixes.