GoCD only has explicit security support for the most recent released version.

Since breaking changes are rare, and generally sign-posted well in advance, we encourage users to keep on a recent or current version to allow for upgrade as easily as possible in the event of a security defect.

Having said this, wherever possible we will try and provide suggested mitigations or workarounds for older versions.

Please report any issues to https://hackerone.com/gocd according to the listed policy.