Security disclosure policy

Does range V3 have a security disclosure policy?

If a security issue is found, would the issue be reported to NIST?

Thanks.