[troyb]

It depends on the security issue but usually it's our responsibility to release a patch that prevents / corrects the flaw.