The Prometheus security policy, including how to report vulnerabilities, can be found here:
https://prometheus.io/docs/operating/security/