Please report vulnerabilities privately through GitHub's private vulnerability reporting, not in a public issue.
Include the Spectre version, your device and Android version, and the steps to reproduce.
Only the latest release receives security fixes.
Release APKs are signed with the certificate whose SHA-256 fingerprint is published in CERT.sha256. An APK signed with any other certificate did not come from this project.