The canonical security policy is maintained at repository root:

• https://github.com/toolostjs/toolost/blob/main/SECURITY.md

If you discover a docs-site specific issue, report it through the same private security channel and mention that the impact is within the documentation deployment or content layer.