Ephaptic is designed to be the backbone of secure applications. As such, we take security vulnerabilities very seriously.
Since Ephaptic is in active development, we generally only backport security fixes to the latest minor version.
However, luckily, Ephaptic is almost always backwards compatible, so it's safe to frequently update to the latest version.
You can report a vulnerability under the security tab. For more info, read this article.