I’m asking this question because I know that, a lot of times, outdated codebase can involve security issues, so I was wondering. There are several apps I found, some have had their last release 1 or 2 years ago, one had it over 5 years ago (built 3 years ago). Most of them use EOL runtimes, too. Some of them also seem to be discontinued when I visit their github pages (last activity / release long ago, lack of feedback from devs on github issues, etc.)
Should I report it if I see any outdated / discontinued apps on flathub? What it flathub's policy on this?
If you find something where the app has been discontinued upstream or the GitHub/Gitlab archived/developer deleted their account, you can open a PR to EOL them Maintenance | Flathub Documentation and tag one of the maintainers or the admins to get it merged.
Reporting won’t help much because these need to be individually dealt with by someone.