Fixes go into a new release of the newest minor version. While sdash is at v0, that is the only version supported.

Report it privately, through GitHub's private vulnerability reporting, not in a public issue. Say which version you used (sdash version prints it), what request, configuration or page shows the problem, and what it lets an attacker do.

The maintainers answer in the advisory and work on the fix there. A fix is released with a GitHub security advisory.