The disclosure policy for security issues in Wasmtime is documented on the Bytecode Alliance website.