So far there's only development branches (main, hip).

Eventually, there should be one stable branch (main) which should be supported with security updates. Additionally there should be development branches (dev) which are not supported.

It's probably best to create an issue here to address security vulnerabilities. They get priority treatment, of course.