Security fixes are made on the main branch and released in the latest version of the template on NuGet.

Please don't report security vulnerabilities through public GitHub issues. Announcing the hole before it's patched helps nobody except the people looking for holes.

Report them privately through GitHub's private vulnerability reporting instead. Include as much detail as you can: what's affected, how to reproduce it, and the impact you expect.

You'll get a response within 7 days. Once the issue is confirmed, a fix is released straight away, outside the usual monthly cycle, and you'll be credited in the advisory unless you'd prefer not to be. Security is the one thing around here that doesn't wait for the 1st.