The HttpComponents Security process and model are on our website's Security page.

If you believe you found a vulnerability in Apache HttpClient, please contact the Apache Security Team.