See the Apache StormCrawler Security Model for the project's threat model, trust boundaries, in-scope / out-of-scope declarations, and known non-findings before reporting security issues. See also SECURITY.md.