You can report vulnerabilities directly through issue. For vulnerabilities that are inconvenient to disclose, you can send them to your mailbox, which should be found in the commit record.

Usually I will reply as soon as possible.