You could check if they have a security.txt[1]. I don’t think it’s terribly common, but I know there are some out there.

[1] https://securitytxt.org/