They also have an active HackerOne bounty program:
Overall, security is not overlooked by Discourse, it’s critical and treated as it should be.