Right now the main branch receives security updates. The latest commit of the main branch is in scope for disclosure.
Subject to change with upcoming releases.
Please report (suspected) security vulnerabilities via Private Vulnerability Reporting on GitHub.