With some exceptions, only the latest minor version (4.x), currently receive patches for security vulnerabilities. The previous minor version might be patched if the fix is simple. No update shall be done to previous major version (aka 3.x) or previous minor releases at this time.
Please report (suspected) security vulnerabilities to the main contributors (listed below) by contacting us directly or on Chat. If you have a fix, don't hesitate to explain or attach it. Using the issue system should be avoided for suspected security vulnerabilities. We'll try our best to reply in due time. If the issue is confirmed, we will see to release a patch as soon as possible depending on complexity.
If you have suggestions on how this process could be improved please submit a pull request.