VerneMQ security updates will first land in the "master" branch and from there go into new releases. Important security updates will lead to a bugfix minor release.
Please use responsible disclosure principles. For any reports and/or questions, contact us at: contact @ octavolabs com.