The security policy for all NATS projects is in the nats-general repository and the current version can be found at: https://github.com/nats-io/nats-general/blob/main/SECURITY.md.
A history of advisories can be found on https://advisories.nats.io/ and our Advisory Policy at https://advisories.nats.io/advisory-policy covers some scenarios of things which are or are not security issues.
For the nats-server specifically, please use the GitHub Security Advisory Reporting flow.
Thank you. Good luck, and stay safe.