This document should (eventually) describe security vulnerability policies for Nav. For now, check our machine-readable policy file.