hyper (and related projects in hyperium) use the same security policy as the Tokio project.

The process for reporting an issue is the same as the Tokio project. This includes private reporting via security@tokio.rs.