APRS messages are transmitted on amateur radio frequencies in plaintext for anyone to read. APRS is never private or secure. Connections to APRS-IS are insecure and only intended for licensed amateur radio operators.
Naturally, being a small project with a team of one, not all versions can be supported in purpetuity.
As such, the latest tagged release version will be utilized for security updates. Older versions will not receive formal updates.
Please report all vulnerabilities via Github issues and they will be addressed as time allows.