twisted/pydoctor project uses the same security policy as twisted/twisted.

For more details please check the Twisted security process

You can send a security report via GitHub Security Advisories