Please do not open a public issue for a security problem. Report it privately through GitHub instead: Security → Report a vulnerability, or open a private advisory.

Say what is affected, how to reproduce it and what an attacker could do with it. You get an answer within a week.

Only the current cask gets fixes. A vulnerability in Configr itself goes to configr-releases.