V8 generally follows Chromium's guidelines.

Security bugs should be reported via this buganizer form or the VRP program. You can set component to Blink>JavaScript (componentid: 1456824) to speed up triaging.

See docs/security/ for V8-specific policies and documentation.