Only the latest release, or the default branch for repositories without releases, gets security fixes. There are no maintained release branches.

Please don't open a public issue. Report it privately through GitHub's private vulnerability reporting: open the repository's Security tab and choose Report a vulnerability. Include what is affected, how to reproduce it, and the impact you expect.

This is a single-maintainer project. Reports are acknowledged within a week, and the advisory is published once a fix is out. You'll be credited in the release notes unless you prefer to stay anonymous. There is no bug bounty.