Please find our statement on security in this document: https://www.openproject.org/docs/development/security/