The security policy can be found at https://github.com/expressjs/.github/blob/master/SECURITY.md