Only the latest 0.x release receives security fixes.

Please report vulnerabilities privately via GitHub private vulnerability reporting rather than a public issue. You will get a response within a week. There is no bug bounty.