The release is exactly the same as v1.3.0, the only change is that the SignMessageLib contract was audited, moved out of examples, and deployed.
See CHANGELOG.md for a complete list of changes.
The changes have been audited and the report is linked in the readme.
Information on the bug bounty can be found in the developer portal.
The addresses of deployed instances of this version can be found in the Safe deployments repository