If you find a vulnerability use the GitHub issue tracker to inform us quickly.

Security critical bugs get the highest possible priority and should be released within some hours (business days) to at most a day (weekends).

If a security vulnerability is found in a supported version we will release a hotfix. Vulnerabilities for non-supported versions may not be fixed (but this highly depends on the version and vulnerability).