Thanking you for taking an interest in reporting a security vulnerability to us.
You can reach us via [email protected]. You can use our PGP key with the fingerprint 2E72 EA5B DDE3 1730 58D7 F87D A0C1 C012 3E2B 296B.
Bear in mind that we are a non-profit run by volunteers, so we can't give you any special rewards and might take some time to reply. But we will respond quickly if you found a serious vulnerability!