Security updates are applied to the latest feature release (1.x) of the compiler, standard library, and build plugins.
A fix will be shipped with the next incremental (1.x.y) or bug fix release (1.x.yz).
All fixes are also applied to the master branch to be included in all upcoming releases.
Instructions for reporting a vulnerability can be found on the Security page.