Only the latest release receives security fixes. Grape ships as a single binary, through Colony and the release page, so the fix for a vulnerability is the next release, not a patch to an older one.

Please report vulnerabilities privately via GitHub Security Advisories ("Report a vulnerability"). Do not open a public issue for exploitable bugs.

Include the version (grape --version), the platform, and the steps or file that reproduce it. The report stays private until a fixed release is out.