To report a security vulnerability please email security@dataverse.org as explained at https://guides.dataverse.org/en/latest/installation/config.html#reporting-security-issues

We usually give credit to security researchers in our release notes.

Advice on securing your installation can be found at https://guides.dataverse.org/en/latest/installation/config.html#securing-your-installation

Security practices and procedures used by the Dataverse team are described at https://guides.dataverse.org/en/latest/developers/security.html