Draft. Vulnerability reporting process will be defined before the first public release. See the security model design record in docs/ (section 11).