OCM Lens is developed in the sbom-lens monorepo, whose security policy applies: https://gitlab.com/everbrightit-group/sbom-lens/-/blob/main/SECURITY.md

Report vulnerabilities privately to tech@everbright-it.de. You will get an acknowledgement within 3 days and an assessment within 14 days. Please do not open public issues for security reports.