Security issues and bugs should be reported privately, via email.
You will receive a reply indicating the next steps in handling your report. If for some reason you do not receive a reply within 24 hours, please follow up via email to ensure the original message was received.
After the initial reply to your report, you will be informed of the progress towards a fix and full announcement. You may be asked to provide additional information or guidance.
We appreciate your efforts to responsibly disclose your findings, and will make every effort to acknowledge your contributions.