See SECURITY.md in the repo root for the full security policy, disclosure process, and compliance posture.