Security Policy & Responsible Disclosure

How to report vulnerabilities responsibly and what safe-harbor expectations apply.