Bytes is part of the Tokio project and uses the same security policy as Tokio.

The process for reporting an issue is the same as for Tokio. This includes private reporting via security@tokio.rs.