Security announcements will be recorded in the CHANGELOG.

To report a security vulnerability use the GitHub Reporting a Security Vulnerability process on the security tab

agithub is an open source project and all support is community driven. As such there are no specific versions which are supported. The newest released version which should contain all security fixes can be found on the GitHub releases page