As Zarf has not yet reached v1.0.0, only the current latest minor release is supported.
Please email security-notice [at] defenseunicorns.com to report a vulnerability. If you are unable to disclose details via email, please let us know and we can coordinate alternate communications.