Prior to a 1.x release security issues will be backported on a best effort bases.

If you think you've found a security issue please reach out to me via keybase rather than logging a public issue.