The canonical security policy is maintained in legal/SECURITY.md and is also published at /security by the application.

Please report suspected vulnerabilities privately to security@trackslash.com, not through a public issue.