We have a bug bounty program on Immunefi. Please report any security issues you find through the Immunefi dashboard, or reach out to security@openzeppelin.com.

Critical bug fixes will be backported to past major releases.

The recommendation is to use the latest version available.

Note that the Solidity language itself only guarantees security updates for the latest release.