Security fixes reach the newest release of the current major version, and the last minor version of every major superseded in the past 18 months. Which versions those are, and what else each one receives, is on the Versioning and Support page.
We take security and data privacy very seriously. Please report a vulnerability privately, through GitHub's private vulnerability reporting (the Report a vulnerability button on this repository's Security tab), rather than in a public issue. You can also contact us at support@douglasneuroinformatics.ca.