Session API Security Advisory
Basically all this means is that the module maintainers haven't opted into Security Advisory Coverage yet. Seems they haven't even opened an application in the review queue.

I asked them to do so in a new issue. As also Acquia does not recommend implementing modules not covered under the Security Advisory Policy (article). Pantheon takes that as a red flag (article), too.

But I wouldn't be worried too much. Just remember to always update this module first. But yeah, I'm not a security expert :)