For now, leanVM is not used in production. Security reports are very much appreciated: please open an issue or submit a pull request. A bounty program is expected to launch soon.