We publish a security policy on our documentation site. It describes how to responsibly report security vulnerabilities to us. It also describes how we will respond and what is not in scope.