Please find our statement on security in this document: https://www.openproject.org/docs/security-and-privacy/statement-on-security/