Last stable version of Mercator always provides security updates.
If you think you have found a potential security issue in Mercator, do not open directly a GitHub issue. Please email us. You can contact the autor.
You can also specify how you would like to be credited for your finding (commit message, release notes or blog post for the new release). We will respect your privacy and will only publicize your involvement if you grant us permission.