Veracode takes the security of it's products seriously. You can find the responsible disclosure policy at veracode.com.