I support the latest major version at any given point. There will be no API changes whenever possible except if a behavior needs to be deliberately changed for security.

I do not follow "responsible" disclosure for issues with this repository, mostly because no-one is paying me to assume such a level of responsibility for this library. All security issues with this library will be treated like any regular public issue, that is, it should be reported on this GitHub repository's Issues tab, and everyone interested will be able to see them publicly there as well, even when they haven't been fixed yet.