See our main security policy at https://github.com/LycheeOrg/Lychee/security/policy

Also we have a security model for the Lychee verification plugin at docs/SECURITY_MODEL.md