Please see security.txt for Atlassian's security disclosure policy.