You can find more details about Tidepool's security policy, responsible disclosure program, and much more at https://www.tidepool.org/security.