We are following semantic versioning with strict backward-compatibility policy. We can ensure that all minor and major version are backward compatible. We are more lenient with patch as the development can move quickly.
If you are just using public API, then feel free to always upgrade. Whenever there is a breaking policies, it will be announced and will be broken.
To report a security vulnerability, please send us an email.