The full policy lives in the docs: Security (or apps/docs/content/docs/security.mdx if browsing the repo).
Summary: only the latest published npm version receives fixes. Please report vulnerabilities privately via GitHub's private vulnerability reporting rather than opening a public issue.