Only the latest release of Pulse gets security fixes. See Releases.

Do not report a vulnerability in a public issue. Use the private form instead: Report a vulnerability. If you cannot use the form, email ingvarch@gmail.com.

Please include:

• A description of the issue and its impact.
• Steps to reproduce or a proof of concept.
• The Pulse version and Go version.
• Any suggestions for a fix.

Reports get a prompt reply. Once the issue is confirmed, the fix goes into a new release and the advisory is published.