At any point in time, only the current major release branch (i.e., '1.x') will be receiving security updates.
If you believe you discovered an issue that may have security implications, please feel free to open a bug report under the project Issues. If you believe the nature of your findings is sensitive, please e-mail us at [email protected] instead. You can expect a response from us within 1-7 days.