Version 1.0 and later receives security updates. Earlier releases do not.

Report vulnerabilities through the Tidelift security contact. Tidelift coordinates the fix and disclosure.