A number of security measures are used including code scanning, secrets scanning, Dependabot alerts, and workflow permission restrictions.

Vulnerabilities can be reported privately to data@isaric.org.