Security fixes go into the latest 4.x release. Older versions don't get fixes; upgrade to the latest 4.x.

Report it privately through GitHub's private vulnerability reporting, not in a public issue, discussion or pull request.

Include the version, the runtime (Node.js, Deno, Bun or Cloudflare Workers), the PostgreSQL version, and the smallest code that shows the problem.

You'll get a reply within a week. Once a fix is released, the advisory is published with credit to you, unless you prefer not to be named.

If the vulnerability also affects the original Postgres.js, say so in the report, and we'll coordinate the disclosure with its maintainer.