they have security.txt file on their domain and mentioned it in some other place