Each repo's RELEASING.md lists supported lines. As a rule, the latest minor of each major receives security fixes.

Email security@hop.top. Do not open public issues for vulnerabilities.

Expect an acknowledgement within 72 hours and a fix or mitigation plan within 14 days for confirmed reports.