We reply within 24 hours on business days. Security reports have a separate channel with a paid bug bounty.