We've released Solidus 1.2.1, 1.1.3, and 1.0.5 to address several security vulnerabilities affecting all versions of Spree and Solidus.
More details can be found on the solidus mailing list
If you have any questions about how to secure your site please stop by our Slack solidusio.slack.com (request an invite).