Each version is supported in the form of patch releases until the next version is merged into master.

To report a vulnerability, either open an issue here on GitHub or join our Discord server. If it is accepted, that means we have begun working on it and it will be fixed if it is at all possible. If it is declined, then that means we have either determined it to not actually be a vulnerability or we have determined it is not feasible to fix it. On GitHub, we are going to notify you when a decision taken, and if accepted, when it is fixed. On Discord, you get live updates.