Now that version 4 is out all previous 3.x releases are considered unsupported.
Report all security issues directly to me security [at] ampache [dot] dev
Use the following format
Subject: Security Issue, Amapche [version number or git branch]
Body: Description, execution steps and contact information to reply. (A github account to tag in the created issue would be good)
All reported issues will be examined and an issue will be created to track against.