tonic (and related projects in hyperium) uses the same security policy as the Tokio project.

The process for reporting an issue is the same as the Tokio project. This includes private reporting via security@tokio.rs.