Only the latest release receives fixes.

Please report it privately with GitHub's "Report a vulnerability" button on the Security tab. Do not open a public issue for it. This is a hobby project, so answers can take a few days.

Breakfast is made for a trusted local network and has no login (see the Security section of the README). Reports about that alone are known. Ways to harm the host, such as path traversal or running commands, are welcome.