At least 2 latest major versions will have a security patches provided.

Security vulnerability should be reported via the issues. When adding security issue, please tag it as a critical one.