The canonical security policy is SECURITY.md.

Use GitHub Security Advisories when available, or contact the repository owner privately. Do not open public issues for suspected vulnerabilities.