Please report it privately on GitHub, not in an issue or a discussion: both are public. Keep it private until a fix is out.

Name the Splat version and the macOS version and describe how to reproduce it. Attach a small sample document if one triggers it.

Splat treats every document as untrusted. Anything that breaks a promise under Privacy and security is a vulnerability, for example a document that runs code, reaches the network without your permission or gets out of a decoder's sandbox.

Security fixes go into the latest release only.