Report security problems privately, through GitHub's private vulnerability reporting: on the repository's Security tab, choose Report a vulnerability, or go straight to https://github.com/hubzero/hubzero-cms/security/advisories/new.
Only the maintainers see the report, and the fix is worked out with you in private before anything is published. Do not open a public issue or pull request for a security problem.
Fixes are made on 2.4-main, the 2.4 release branch.