Please report any vulnerabilities discovered in Fleet products to fleetdm.com/contact.
Fleet endeavors to acknowledge and fix any reported vulnerabilities ASAP. Acknowledgement is typically within 1 business day, and patches usually go out within 5 business days (depending on severity and timing).