The argocd-agent project is not ready for production yet. However, we do appreciate people fixing security issues in the code.
At this point in time, that means prior to GA or close to that, we will neither issue CVEs nor security advisories for discovered and fixed security issues. However, we will mention issues in release notes and we are happy to credit people who helped out.
We do not have a support matrix yet. We do plan to follow the support matrix of Argo CD.
Right now, please feel free to raise a GitHub issue and/or a PR with a fix for any vulnerability you come across.