PowerShell/.github/SECURITY.md

Security Vulnerabilities

Security issues are treated very seriously and will, by default, takes precedence over other considerations including usability, performance, etc... Best effort will be used to mitigate side effects of a security change, but PowerShell must be secure by default.

Reporting a security vulnerability

If you believe that there is a security vulnerability in PowerShell, it must be reported using https://aka.ms/secure-at to allow for Coordinated Vulnerability Disclosure. Only file an issue, if MSRC has confirmed filing an issue is appropriate.