Security vulnerabilities will be addressed for the last 2 major versions of the project, older versions are not supported.
Bug fixes and features will only be fixed and added into the most recent major version.
If you find a vulnerability, please contact federico.zivolo [AT] gmail [DOT] com, do not disclose the vulnerability on the public issue tracker.
Alternatively, visit https://tidelift.com/security